Getting started with Content or Manifest download failures

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

To understand ManifestDownloadFailure (macOS, Windows) and ContentDownloadFailure (Linux) messages

Environment

• Carbon Black Cloud: All Versions
• Carbon Black Cloud Sensor (Linux): v2.12.x.x and Higher
• Carbon Black Cloud Sensor (macOS): v3.5.3.x and Higher
• Carbon Black Cloud Sensor (Windows): v3.6.0.x and Higher

Resolution

1. Why should I care about these messages?
   1. The sensor is not fully operational or protected without manifest or content rules. This should be remediated ASAP.
      1. How to check current dynamic Sensor Management Content Manifests (Windows)
      2. Is access to content.carbonblack.io required?
2. What ports do I need to have open?
   1. What Ports must be opened on the Firewall and Proxy Servers?
3. How can I check the connection and see failures on the local endpoint?
   1. Windows:
      1. How to check current dynamic Sensor Management Content Manifests (Windows)
      2. Verify Connection to content.carbonblack.io
   2. Linux:
      1. How to check current dynamic Sensor Management Content Manifests (Linux)
      2. Verify Connection to content.carbonblack.io
   3. macOS:
      1. How to check current dynamic Sensor Management Content Manifests (macOS)
      2. Verify Connection to content.carbonblack.io
4. Which steps should I take to troubleshoot this?
   1. Windows:
      1. Remediating ManifestDownloadFailure alarms (Windows)
   2. Linux:
      1. How to remediate ContentDownloadFailure alarms (Linux)
   3. macOS:
      1. How to remediate ManifestDownloadFailure alarms (macOS)

Additional Information

What’s the static IP address or hostname used by the back-end?

SSL cipher suites that are supported/accepted for communications

The Sensor Manifest Download Errors query can be used to discover all sensors which are running into this issue