CB Response: Non-Root User Making Calls to Master in Audit.log

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

The '/var/log/audit/audit.log' file indicates 'non-root' user making calls to Master server. In this example 'testuser' should be 'root':

username timestamp ip_address request_method request_path result description
testuser 2020-03-17 07:50:54.982967-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:50:23.925526-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:49:52.866166-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:49:03.794608-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:48:32.736459-04:00 10.34.138.3 GET /api/info 200 OK

 

Environment

• CB Response Server: All Versions
• Clustered
• Unified View Server: All Versions

Cause

A 'non-root' user performed steps of adding CB Clusters to the Unified View Server. 

Resolution

1.  As 'root', or administrative user, remove the CB Clusters from the Unified View Server
2.  Re-add CB Clusters to Unified View Server 

a. To remove a CB Cluster from Unified View Server:

1. If the Cluster Management page is not already showing, in multi-cluster mode, click the Carbon Black logo at the top left of the navigation bar.
2. Click to select the cluster to delete.
3. At the top of cluster details in the right pane, click Delete.
4. Confirm the deletion by clicking Delete Cluster in response to the Confirmation prompt.

b. To add a CB Cluster to Unified View Server:

1. Log in to Unified View using an administrator account.
2. If you are viewing a single cluster through Unified View, click the browser tab for the multi-cluster view.
3. If the Cluster Management page is not already showing, click the Carbon Black logo at the top left of the navigation bar. (If clicking this logo brings you to a HUD page, you are still in single-cluster view and should click on a different browser tab. There is no HUD page in Unified View.)
4. In the list of clusters in the left pane, click Add Cluster.
5. Complete settings in the Add Cluster dialog box

 

 

Additional Information

• Reference Pg 21 - 22 of the Unified View User Guide to 'Add or Remove Clusters'