EDR: Error retrieving feed: 401 Client Error: UNAUTHORIZED
book
Article ID: 287965
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Feeds are not updating
- Task errors in the console
- /var/log/cb/enterprise/enterprise.log is filled with errors similar to this
{"task_type": "Task", "task_name": "FeedSynchronizer", "timestamp": "2024-02-27 22:18:49.459692-06:00", "error_text": "Error during synchronization of feed LivingOffTheLandDrivers(21): Error retrieving feed: 401 Client Error: UNAUTHORIZED for url: https://threatintel.bit9.com/api/v1/cbfeed/feed/LivingOffTheLandDrivers?server_token=<MY TOKEN>
Cause
TicURL is misconfigured
Resolution
- Open /etc/cb/cb.conf
- Find the config TicURL
- Correct it to match the FQDN of the error message, in the example TicURL=https://threatintel.bit9.com
Feedback
thumb_up
Yes
thumb_down
No