EDR: Triage alerts stop appearing on console

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Triage alerts stop working

Environment

• EDR Server: 6.x and higher

Resolution

1. This script is run *as root* so it should be writable only to the root user. All executables launched should also be modified with this in mind.
2. Edit /etc/cron.d/cb and adjust the watchlist search line to use root and include -vvvv.
3. Comment out the existing 'watchlist_search' line in /etc/cron.d/cb and add:

*/10 * * * * root /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -vvv watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1

4. Edit /etc/cb/cron/cb.cron.template in order for settings to persist after restart.