App Control: How to troubleshoot a Network Connector issue

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Troubleshooting steps to triage a network connector issue.

Environment

• App Control: All Versions
• All supported network connectors (FireEye, Palo Alto Network, Check Point)

Resolution

1. Confirm that the network connector is supported version using the Supported Integration document here.
2. Verify if there are other security application on the system and exclusions per.
3. Please provide the following:
   1. The behavior or symptoms
   2. Did it work before
   3. When the issue started
   4. What changed around the time that the issue started
   5. Any error message
   6. Any Proxy/Firewall setting change
4. Try restarting the following services and check if the issue continues:
   1. App Control Server service
   2. App Control  Reporter service
   3. App Control  Connector for Check Point service (if issue is related to Check Point)
5. Collect logs:
   1. Collecting Logs for Troubleshooting (Cb Protection Server)
   2. Screenshot of the connector setting from the console (System Configuration > Connector)
   3. For FireEye, debug.log and error.htm from %Program Files%\bit9\Integrations\FireEye\listener\ folder
   4. Please provide the results from this query:

      use das
      select * from dbo.antibody_analysis_providers

   5. On this query provide the results and check the analysis_param column to verify if it has a NULL entry or if it specifies which network connector is supposed to provide the analysis.

      use das
      select * from dbo.antibody_analysis_files where status = "Error"

      ​​​​​
6. If the issue is related to upload, verify that the source endpoint is online and the repository folder is available.
7. If the issue is related to permission, verify that the account for the repository folder has proper permission to read/write/delete.
8. If using an Event Rule to trigger file analysis on the network connector, please provide the details of the rule and verify the settings.