EDR: Sensor Details Page is Blank if the Sensor is Using a Minion

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The sensor details page is blank for all sensors except ones with Node ID: 0
• In the coreservices debug.log you may see the following errors 

<err> cb.api.api_engine - Error getting sensor activity from remote node Node 1 <minion1> 
ConnectionError: HTTPSConnectionPool(host='<minion1>', port=8443): Max retries exceeded with url: /api/v1/sensor//activity (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at >: Failed to establish a new connection: [Errno 111] Connection refused',))

Environment

• EDR (Formerly Carbon Black Response) Server: All Supported Versions

Cause

This can happen if the Master is set to use a different API port than the Minion's default 443

Resolution

1. Check the /etc/cb/cb.conf file on the master for a MinionApiPort value
2. Change it to 443

Additional Information

• A common value for MinionApiPort is 8443 and 443
• If this setting does not exist in your configuration, it defaults to 443
• If ports are configured properly but still receiving 403 errors with IP whitelisting enabled:
  • Ensure master and minion IPs are whitelisted, respectively inside of the /var/cb/nginx/props/nginx.runtime.ipfilters.prop file.  Whitelist example:

allow 127.0.0.1;
allow 128.164.42.0/27;
allow 208.31.160.48/29;