CB Response: Live Response API Has Frequent Timeouts For Large File Downloads

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Live Response API has frequent timeouts when downloading large files (approx 100Mb or greater)

Environment

• CB Response Server: All Versions
• CB Live Response API

Cause

The default for the 'CbLRSensorPollTimeout' setting is 60 seconds and in low bandwidth environments this may not be large enough.

Resolution

1. On the CB Response server open /etc/cb/cb.conf

vi /etc/cb/cb.conf

2. Edit the setting called 'CbLRSensorPollTimeout'
   1. The new value should be 120 (default 60)