EDR: Sensor Details Page is Blank if the Sensor is Using a Minion
search cancel

EDR: Sensor Details Page is Blank if the Sensor is Using a Minion

book

Article ID: 289280

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • The sensor details page is blank for all sensors except ones with Node ID: 0
  • In the coreservices debug.log you may see the following errors 
<err> cb.api.api_engine - Error getting sensor activity from remote node Node 1 <minion1> 
ConnectionError: HTTPSConnectionPool(host='<minion1>', port=8443): Max retries exceeded with url: /api/v1/sensor//activity (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at >: Failed to establish a new connection: [Errno 111] Connection refused',))

Environment

  • EDR (Formerly Carbon Black Response) Server: All Supported Versions

Cause

This can happen if the Master is set to use a different API port than the Minion's default 443

Resolution

  1. Check the /etc/cb/cb.conf file on the master for a MinionApiPort value
  2. Change it to 443

Additional Information

  • A common value for MinionApiPort is 8443 and 443
  • If this setting does not exist in your configuration, it defaults to 443
  • If ports are configured properly but still receiving 403 errors with IP whitelisting enabled:
    • Ensure master and minion IPs are whitelisted, respectively inside of the /var/cb/nginx/props/nginx.runtime.ipfilters.prop file.  Whitelist example:
allow 127.0.0.1;
allow 128.164.42.0/27;
allow 208.31.160.48/29;