API errors in custom applications and/or scripts after September 5th 2024

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Container
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload

Issue/Introduction

• API's suddenly stop working
• The format of Alert data from the Data Forwarder has suddenly changed and the consuming systems cannot ingest it
• Error messages appear

HTTP Error 410: Gone

• API calls fail to return data

Environment

• Carbon Black Cloud Console: Current version
• Endpoint Standard API:
  • Alerts v6 API
  • Sensor Update Services v2 API
  • Enriched Events Search API
  • Process Search Suggestions v1
  • GET Process Search Validation v1
  • Policy v3 REST API
  • Devices v3 REST API
  • Live Response v3 API
  • Data Forwarder Alert Schema v1

Cause

• Deactivation of listed APIs listed above.
• Automatic upgrade of active Alert Forwarders that were using Alert Schema v1 to Alert Schema v2.
• As of July 31st 2024 Data Forwarder Alert Schema v1 will be removed and unavailable for customer use.

Resolution

• Customers must update their custom applications and scripts with new APIs
  • API and Schema Migration - https://developer.carbonblack.com/reference/carbon-black-cloud/api-migration/