CB Response: Threat Intel Icons are not displaying

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When navigating to the Threat Intelligence page, the Threat Intelligence Feed Icons are showing as broken images. 

Environment

• CB Response Server: 5.2.x and 6.x

Cause

This is due to the Content-Security-Policy not including the img-src property to allow the Threat Intel images to load the data:image.

Resolution

1. Log out of the CB Response console
2. On the CB Response server navigate to the following directory /etc/cb/nginx/conf.d/includes
3. Make a backup of the cb.server.body file.
   • cp cb.server.body cb.server.body.BAK
4. Using a text editor amend the following line;
   • From
     • add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'";
   • To
     • add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:";
5. Restart the cb-nginx service
   • service cb-nginx restart
6. Log into the CB Response console and navigate to the Threat Intelligence page. The Threat Intel icons will be present.