EDR: Isolated sensor cannot communicate with server via proxy

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Sensors using proxy communication receive timeout errors when connecting to the server under isolation

Environment

• EDR Server: 6.5.0 and higher
• EDR Windows Sensor: 6.2.4 and higher
• EDR macOS Sensor: 6.2.7 and higher
• Proxy server

Cause

The proxy IP is being blocked per isolation behavior

Resolution

Warning: Adding the proxy to isolation exclusions will mean any communication that uses the proxy will still be able to pass through
Update the sensor group to include exclusions for the proxy address to allow communication.

1. On the navigation bar, click Sensors
2. Click the gear icon next to the intended sensor group to add isolation exclusions
3. Click Isolation Exclusions > Add Exclusion
4. Enter a description and the IPv4 address or domain URL that specifies the proxy (253 character maximum)
5. Select Enable this exclusion > OK
6. Save Group

Additional Information

Permissions required: Global Administrators (on premises) or Administrators(cloud), or as a user who has Isolate sensor permission and membership on a team with the Analyst role for the sensor group