Carbon Black Cloud: Qradar Connection Fails to Establish Connection to the Cloud Backend

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

When attempting to establish a connection from the CB Defense App for IBM QRadar to the Carbon Black Cloud backend the following error message may be observed

• "Cbdefense responded in undefined seconds"

Environment

• Carbon Black Cloud Console: All Versions
• CB Defense App for IBM QRadar: Version 1.0.0
• IBM QRadar: Version 7.2.8 and higher

Cause

This can happen if the URL is incorrect

Resolution

Modify the following URL in the CB Defense App for IBM QRadar configuration panel to the corresponding API URL here

• api-prod05.conferdeploy.net TO defense-prod05.conferdeploy.net

Additional Information

Connectivity to the above URLs can be tested with the following command:

• curl -X POST https://defense-prod05.conferdeploy.net/integrationServices/v2/session -H 'Content-Type: application/json' -H 'X-Auth-Token: {api_key}/{api_id}' -d '{ "apiKey": "{api_key}", "connectorId": "{api_id}"}'
  • {api_key} and {api_id} will need to be replaced with their respective values from API keys page in the console