CB PSC: Multiple Live Response sessions for an endpoint will be killed if one session detaches

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• When a user runs detach -q in one Live Response session for an endpoint, other users with a session open on that endpoint will receive 404s when attempting to execute commands

Environment

• PSC Console: .43.x and Higher
  • CB Defense
  • CB ThreatHunter
• CB PSC Sensor: 3.2 and Higher

Cause

• This behavior is expected. Live Response will only create one session on an endpoint. Issuing the detach command tells the sensor to remove the session from memory. 

Resolution

• Use the "End my session" button or detach command without the -q flag to just disconnect one session
• Users that lose connection can refresh the page to establish a new connection