Carbon Black Cloud: Netskope integration failing with 403s

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• After configuring the connector, query requests fail with 403 Forbidden errors in the Netskope logs for queries to feedmgr
• Permissions match those of the setup guide

Environment

• Carbon Black Cloud Console: .72 and Higher
• Netskope Carbon Black Cloud Integration: 1.0.3

Cause

Missing permissions for org.feeds

Resolution

1. Under API Access > Access Levels, Edit the Access Level configured for the Netskope integration
2. Ensure the following are checked

Name	Permissions
org.alerts	READ
org.watchlists	CREATE, READ, UPDATE
org.feeds	CREATE, READ, UPDATE

3. Save changes 

Additional Information

Future iterations of documentation should be updated on the Netskope side to ensure all permissions are listed