EDR: 404 Errors in Process Analysis When the Sensor is Hidden From the Console
book
Article ID: 289281
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
When selecting a process the process analysis gives a 404 error
The sensorID of the sensor the process belongs to doesn't show up in the console
Environment
EDR Server: 7.7.2 and Higher
Cause
This happens when the API is being blocked from interacting from that sensorID due to the SensorLookupInactiveFilterDays in the cb.conf or Filter by Inactive Days in the console
Resolution
This is being looked into via EA-23595
As a workaround make sure that the sensor is not being filtered out of the console when trying to triage it's process events