Carbon Black Cloud: What is indicated when an event contains the message "the operation failed"?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

When an event states "the operation failed", what does this indicate?

Environment

• Carbon Black Cloud: All Versions

Resolution

• The operation failed message indicates that the application was not able to complete its intended operation, but the failure was not caused by a deny or terminate action.
• In some cases Carbon Black Cloud may be responsible for the failure though the sensor did not take a deny or terminate action.  To determine whether this is the case do the following:
  1. Navigate to the endpoints page, and search for a sensor that can be used to test the application.
  2. Place the sensor in bypass mode.
  3. Re-run the application and watch for any errors.
  4. If the application runs normally with the sensor in bypass, Carbon Black Cloud is likely causing the errors.

Additional Information

• In many cases the end user will likely not notice these failures as they will have no impact on the application.
• If "the operation failed" events are impacting end users and Carbon Black Cloud is the culprit, please gather sensor logs, a process monitor, and open a case with support.