Carbon Black Cloud: Last Check-In Not Updating And Live Response Button Is Gray For Active Sensors

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Sensor status shows as Active on the Endpoints page
• Last Check-In date and time not updating or taking longer to update for Sensor(s)
• Go Live (Live Response) button is grayed-out for the Sensor(s)
• Current Events showing on the Investigate page for the Sensor(s)
• Sensor installed and running on endpoint

Environment

• Carbon Black Cloud Console: All Versions
  • Audit & Remediation (was CB LiveOps)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Version

Cause

Under investigation

Resolution

Carbon Black is working on creating a permanent fix for this issue and a fix will be made available as soon as we're able.

Temporary Workaround

1. Log into Console
2. Go to Endpoints page
3. Find device by name and expand Endpoint details
4. Copy Device ID
5. Use the following URL to manually start a Live Response session

   https://<DashboardURL>/live-response/<device_id>
   
   Example
   https://defense-prod05.conferdeploy.net/live-response/123456
   

Additional Information

• Replace all items enclosed in <> with actual values, including <> (i.e., <device_id> becomes 123456)
• To verify that sensors are checking in correctly follow these steps
  1. Go to the Endpoints page
  2. Search for the desired Device Name
  3. Click on the Device Name (hyperlink) to be redirected to the filtered Investigate page for the selected Device
  4. Review the Events on this page to verify their date and time are recent (within the last 5-10 minutes)