EDR: 'Error: NOT FOUND - Session X currently processing command X' error seen in Live Response GUI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When executing commands in a Live Response session the command fails with:

Error: NOT FOUND - Session X currently processing command X

Environment

• EDR (formerly CB Response) Console: All Versions
• EDR (formerly CB Response) Cloud: Current Version

Cause

Multiple commands are being processed against a session and there are stale sessions still active against a host which have not been closed accordingly.

Resolution

1. Ensure when exiting a Live Response session the "detach" command is executed.
2. Check within the "Go Live" GUI for any existing sessions which have not been closed.
   1. Select "Go Live"
   2. Type "session" and press enter. 
   3. Find the relevant "Session ID" this will be a number.
   4. Then execute "session close <Session ID>"
      1. e.g. session close 9
   5. This will return a "Session closed." message.
3. Reconnect to the host in a Live Response session.