EDR: 'Error: NOT FOUND - Session X currently processing command X' error seen in Live Response GUI
book
Article ID: 290247
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
When executing commands in a Live Response session the command fails with:
Error: NOT FOUND - Session X currently processing command X
Environment
EDR (formerly CB Response) Console: All Versions
EDR (formerly CB Response) Cloud: Current Version
Cause
Multiple commands are being processed against a session and there are stale sessions still active against a host which have not been closed accordingly.
Resolution
Ensure when exiting a Live Response session the "detach" command is executed.
Check within the "Go Live" GUI for any existing sessions which have not been closed.
Select "Go Live"
Type "session" and press enter.
Find the relevant "Session ID" this will be a number.