EDR: Log in via SSO failing with 404s
book
Article ID: 290289
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- /api/auth requests in /var/log/cb/nginx/access.log have extra text such as a telnet command at the end
Cause
Something is altering the request to go to a non-existent URL
Resolution
Whatever causes the redirect must be removed.
Additional Information
- This can occur if an automated threat scanner is in place or something is attempting a proxy redirect
- Caching in the browser may cause logins to fail even after the request is fixed
Feedback
thumb_up
Yes
thumb_down
No