Carbon Black Cloud: Last Check-In Not Updating And Live Response Button Is Gray For Active Sensors
book
Article ID: 290250
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
- Sensor status shows as Active on the Endpoints page
- Last Check-In date and time not updating or taking longer to update for Sensor(s)
- Go Live (Live Response) button is grayed-out for the Sensor(s)
- Current Events showing on the Investigate page for the Sensor(s)
- Sensor installed and running on endpoint
Environment
- Carbon Black Cloud Console: All Versions
- Audit & Remediation (was CB LiveOps)
- Endpoint Standard (was CB Defense)
- Enterprise EDR (was CB ThreatHunter)
- Carbon Black Cloud Sensor: All Versions
- Microsoft Windows: All Supported Version
Resolution
Carbon Black is working on creating a permanent fix for this issue and a fix will be made available as soon as we're able.
Temporary Workaround
- Log into Console
- Go to Endpoints page
- Find device by name and expand Endpoint details
- Copy Device ID
- Use the following URL to manually start a Live Response session
https://<DashboardURL>/live-response/<device_id>
Example
https://defense-prod05.conferdeploy.net/live-response/123456
Additional Information
- Replace all items enclosed in <> with actual values, including <> (i.e., <device_id> becomes 123456)
- To verify that sensors are checking in correctly follow these steps
- Go to the Endpoints page
- Search for the desired Device Name
- Click on the Device Name (hyperlink) to be redirected to the filtered Investigate page for the selected Device
- Review the Events on this page to verify their date and time are recent (within the last 5-10 minutes)
Feedback
thumb_up
Yes
thumb_down
No