Verify Connection to content.carbonblack.io

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Workload

Issue/Introduction

Steps for checking the connection from a local machine to the content delivery network (https://content.carbonblack.io).

Environment

• Carbon Black Cloud Windows Sensor: 3.6.0.x and Higher
• Carbon Black Cloud Mac Sensor: 3.5.3.x and Higher
• Carbon Black Cloud Linux Sensor: 2.12.x and Higher
• Microsoft Windows: All Supported Versions
• macOS: All Supported Versions
• Linux: All Supported Versions

Cause

 

Resolution

Windows

Via Live Response

1. Start Live Response session with desired device
2. Check connectivity

   execfg powershell Invoke-WebRequest -URI https://content.carbonblack.io

3. Successful connection response is an error for missing Key-Pair-Id

   Invoke-WebRequest : MissingKeyMissing Key-Pair-Id query parameter or cookie value
   At line:1 char:1
   + Invoke-WebRequest -URI https://content.carbonblack.io
   + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
       + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

 

Via Browser

1. Open desired browser
2. Go to https://content.carbonblack.io
3. Successful connection response is an XML error for missing Key-Pair-Id

   This XML file does not appear to have any style information associated with it. The document tree is shown below.
   <Error>
   <Code>MissingKey</Code>
   <Message>Missing Key-Pair-Id query parameter or cookie value</Message>
   </Error>

 

Via Powershell

1. Launch Powershell
2. Run command to connect to https://content.carbonblack.io

   Invoke-WebRequest -URI https://content.carbonblack.io

3. Successful connection response is an error for missing Key-Pair-Id

   Invoke-WebRequest : MissingKeyMissing Key-Pair-Id query parameter or cookie value
   At line:1 char:1
   + Invoke-WebRequest -URI https://content.carbonblack.io
   + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
       + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

 

Via curl (Windows 10 17063 and above)

1. Launch cmd.exe
2. Run command to connect to https://content.carbonblack.io

   curl https://content.carbonblack.io

3. Successful connection response is an XML error for missing Key-Pair-Id

   <?xml version="1.0" encoding="UTF-8"?><Error><Code>MissingKey</Code><Message>Missing Key-Pair-Id query parameter or cookie value</Message></Error>

 

macOS / Linux

Via Browser

1. Open desired browser
2. Go to https://content.carbonblack.io
3. Successful connection response is an XML error for missing Key-Pair-Id

   This XML file does not appear to have any style information associated with it. The document tree is shown below.
   <Error>
   <Code>MissingKey</Code>
   <Message>Missing Key-Pair-Id query parameter or cookie value</Message>
   </Error>

 

Via cURL

1. Launch terminal emulator
2. Run command to connect to https://content.carbonblack.io

   curl https://content.carbonblack.io

3. Successful connection response is an XML error for missing Key-Pair-Id

   <?xml version="1.0" encoding="UTF-8"?><Error><Code>MissingKey</Code><Message>Missing Key-Pair-Id query parameter or cookie value</Message></Error>

 

Via wget

1. Launch terminal emulator
2. Run command to connect to https://content.carbonblack.io

   wget https://content.carbonblack.io

3. Successful connection response is a 403 error

   Resolving content.carbonblack.io (content.carbonblack.io)... <ip_addresses> ...
   Connecting to content.carbonblack.io (content.carbonblack.io)|<ip_address>|:443... connected.
   HTTP request sent, awaiting response... 403 Forbidden
   YYYY-MM-DD hh:mm:ss ERROR 403: Forbidden.

 

Additional Information

• Since these tests are not being done using the authentication employed by the Sensor, they will fail in this way when there are no other network errors/issues
• Misconfigured firewalls or proxies can present a number of different errors outside of the above, and should be investigated with your networking team
• Great test when getting an alert "Detected endpoints without fully operational sensors, likely due to your organization’s firewall, proxy, or network settings".