Getting started with Content or Manifest download failures

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

To understand ManifestDownloadFailure (macOS, Windows) and ContentDownloadFailure (Linux) messages

Environment

• Carbon Black Cloud: All Versions
• Carbon Black Cloud Sensor (Linux): v2.12.x.x and Higher
• Carbon Black Cloud Sensor (macOS): v3.5.3.x and Higher
• Carbon Black Cloud Sensor (Windows): v3.6.0.x and Higher

Resolution

Why should I care about these messages?

• The sensor is not fully operational or protected without manifest or content rules. This should be remediated as soon as possible.

What ports do I need to have open?

• Firewall Configuration

How can I check the connection and see failures on the local endpoint?

• Windows:
  • How to check current dynamic Sensor Management Content Manifests (Windows)
  • Verify Connection to content.carbonblack.io
• Linux:
  • How to check current dynamic Sensor Management Content Manifests (Linux)
  • Verify Connection to content.carbonblack.io
• macOS:
  • How to check current dynamic Sensor Management Content Manifests (macOS)
  • Verify Connection to content.carbonblack.io

Which steps should I take to troubleshoot this?

• Windows:
  • Remediating ManifestDownloadFailure alarms (Windows)
• Linux:
  • How to remediate ContentDownloadFailure alarms (Linux)
• macOS:
  • How to remediate ManifestDownloadFailure alarms (macOS)

Additional Information

What’s the static IP address or hostname used by the back-end?

SSL cipher suites that are supported/accepted for communications

The Sensor Manifest Download Errors query can be used to discover all sensors which are running into this issue