Carbon Black Cloud: Splunk shows "network connection error" trying to configure the CBC Splunk Add-on

Products

• Carbon Black Cloud Prevention

Issue/Introduction

After configuring the Carbon Black Cloud Splunk Add-on, this error occurs in the Splunk dashboard:

error_message="Received a network connection error from https://defense-prod05.conferdeploy.net: 
   HTTPSConnectionPool(host='defense-prod05.conferdeploy.net', port=443): 
   Max retries exceeded with url: /appservices/v6/orgs/N5DFMV67/alerts/_search 
   (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x00000210EAB92448>: 
   Failed to establish a new connection: [WinError 10061] 
   No connection could be made because the target machine actively refused it'))

 

Environment

• Carbon Black Cloud Splunk Add-on: 1.x
• Splunk: 1.2.x

Cause

The "Proxy" tab of the configuration pages was misconfigured.

Resolution

The "Proxy" tab should have both of these options checked:

1. Use SSL
2. Verify SSL