EDR: ThreatConnect playbook connector not updating threat reports on incremental sync
search cancel

EDR: ThreatConnect playbook connector not updating threat reports on incremental sync

book

Article ID: 289084

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • The feeds for the ThreatConnect playbook connector only sync every 24 hours during the cron for the FULL sync.
  • Incremental syncs run via the cron job do not update the ThreatConnect threat reports

Environment

  • EDR Server: All Versions
  • ThreatConnect Playbook Connector

Cause

The timestamps in the ThreatConnect json data are not being updated correctly by ThreatConnect.

Resolution

The ThreatConnect playbooks must be setup to regularly update the timestamps in the json files when changes are applied. The feed sync job will only pull new infromation when the timestamp shows a value that is past the time it last synced.