EDR: 404 Errors in Process Analysis When the Sensor is Hidden From the Console
search cancel

EDR: 404 Errors in Process Analysis When the Sensor is Hidden From the Console

book

Article ID: 289281

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • When selecting a process the process analysis gives a 404 error
  • The sensorID of the sensor the process belongs to doesn't show up in the console

Environment

  • EDR Server: 7.7.2 and Higher

Cause

This happens when the API is being blocked from interacting from that sensorID due to the SensorLookupInactiveFilterDays in the cb.conf or Filter by Inactive Days in the console

Resolution

  • This is being looked into via¬†EA-23595
  • As a workaround make sure that the sensor is not being filtered out of the console when trying to triage it's process events