EDR: 404 Errors in Process Analysis When the Sensor is Hidden From the Console

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When selecting a process the process analysis gives a 404 error
• The sensorID of the sensor the process belongs to doesn't show up in the console

Environment

• EDR Server: 7.7.2 and Higher

Cause

This happens when the API is being blocked from interacting from that sensorID due to the SensorLookupInactiveFilterDays in the cb.conf or Filter by Inactive Days in the console

Resolution

• This is being looked into via EA-23595
• As a workaround make sure that the sensor is not being filtered out of the console when trying to triage it's process events