EDR: Error retrieving feed: 401 Client Error: UNAUTHORIZED
search cancel

EDR: Error retrieving feed: 401 Client Error: UNAUTHORIZED

book

Article ID: 287965

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Feeds are not updating
  • Task errors in the console
  • /var/log/cb/enterprise/enterprise.log is filled with errors similar to this 
    {"task_type": "Task", "task_name": "FeedSynchronizer", "timestamp": "2024-02-27 22:18:49.459692-06:00", "error_text": "Error during synchronization of feed LivingOffTheLandDrivers(21): Error retrieving feed: 401 Client Error: UNAUTHORIZED for url: https://threatintel.bit9.com/api/v1/cbfeed/feed/LivingOffTheLandDrivers?server_token=<MY TOKEN>

Environment

  • EDR Server: All Versions

Cause

TicURL is misconfigured 

Resolution

  1. Open /etc/cb/cb.conf
  2. Find the config TicURL
  3. Correct it to match the FQDN of the error message, in the example TicURL=https://threatintel.bit9.com
Powered by Wolken Software