Hosted EDR: Unable to Add User to a Team

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Attempting to assign User(s) to a Team
• When User page is refreshed the Team is no longer assigned, ‘Users’ field is blank.

Environment

• Hosted EDR: Version 6.3.0 and Higher

Cause

User(s) are assigned Administrator Role.

Resolution

1. Open CB Response Console > click on Users button on the left hand side
2. Select specific user from list > click into the users details
3. Click button to change the account to be a "User" and not an "Administrator"

Additional Information

• From Pg 70, 'Overview of Cloud User Management' in the 6.3.0 User Guide: 

Administrators can also be assigned to teams, although team membership doesn’t affect them unless their administrator status is disabled.

• The Global Administrator (on premises) or Administrator (cloud) has access to all functionality for all computers in all sensor groups. Due to the power of the Administrator role it cannot be placed into a specific Team as that user would still retain the ability to access all functionalities across the other Teams established. One of the driving factors of enhancing the role permissions within the CB Response server was to: 

1.  Reduce the amount of Global/Administrators required 
2. Allow for more granular permission controls over regular users i.e. limit their access to specific sensor groups and or functionalities e.g. Live Response, Ban Hashes, Isolate Sensors