EDR Server: Feed Sync "Error during synchronization of feed Bit9AdvancedThreats"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• /var/log/cb/enterprise.log shows feed sync error

  • "Error during synchronization of feed Bit9AdvancedThreats(18): ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))"

Environment

• EDR Server: All Versions

Cause

SSL communication between the server and the threat feed server are failing due to a network error which could include

• Intermediary interfering with certificates
• Misconfigured firewall rules

Resolution

The configuration interfering with communication must be updated. 

Additional Information

The following command can be run to test connection 

curl -v --cert /etc/cb/certs/carbonblack-alliance-client.crt --key /etc/cb/certs/carbonblack-alliance-client.key https://threatintel.bit9.com/api/v1/cbfeed/feed/SRSThreat