CB Response: Events no longer forwarded to QRadar

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Events are no longer ingested by QRadar
• Service cb-event-forwarder no longer running
• Cannot start cb-event-forwarder

Environment

• CB Response Server: 6.2.2
• CB Event-Forwarder
• QRadar

Cause

The API token in /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf is no longer valid

Resolution

1. Copy API token from user UI under Username > Settings > API Token
2. Edit /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf
3. Restart the event-forwarder