CB PSC: Multiple Live Response sessions for an endpoint will be killed if one session detaches
book
Article ID: 290313
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
When a user runs detach -q in one Live Response session for an endpoint, other users with a session open on that endpoint will receive 404s when attempting to execute commands
Environment
PSC Console: .43.x and Higher
CB Defense
CB ThreatHunter
CB PSC Sensor: 3.2 and Higher
Cause
This behavior is expected. Live Response will only create one session on an endpoint. Issuing the detach command tells the sensor to remove the session from memory.
Resolution
Use the "End my session" button or detach command without the -q flag to just disconnect one session
Users that lose connection can refresh the page to establish a new connection