EDR: Sensors no longer checking in after migration to new server
book
Article ID: 290546
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Sensor checks into the server once and never again
- sensorcomms.log shows HResult - 0x80190190, which translates to Facility[25] Code[0190] Severity[1] Bad request (400).
- nginx access.log shows HTTP 400 responses
Environment
- EDR (formerly Cb Response) Server: All Versions
Cause
The cb-client-ca certificates were changed after group certificates were already created.
Resolution
- Revoke previous sensor group certificates: https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-revoke-a-sensor-group-certificate-version-6-2/ta-p/69193
- Any sensors already connected to the server will need to be uninstalled and re-installed
Feedback
thumb_up
Yes
thumb_down
No