EDR: error when attempting App Control integration

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When attempting to test the connection in the EDR CB Protection side, a red toaster message is displayed. Additionally, the following error code is written to /var/log/cb/coreservices/debug.log:

2020-08-20 10:37:44 [21554] <err>  cb.flask.blueprints.api_blueprint - Failed attempt to connect to the Carbon Black platform server
Traceback (most recent call last):
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/flask/blueprints/api_blueprint.py", line 1608, in platform_server_test
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/core/platform/check.py", line 29, in send_post
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/core/actions/types/http_request/http_router.py", line 40, in post
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/core/actions/types/http_request/http_router.py", line 50, in http_request
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/utils/httpcomms.py", line 125, in post
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/utils/httpcomms.py", line 145, in _make_call
  File "/usr/share/cb/virtualenv/lib/python3.8/site-packages/cb/utils/httpcomms.py", line 207, in __make_call
  File "/usr/share/cb/virtualenv/lib64/python3.8/site-packages/requests/models.py", line 941, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://server_url/actions/watchlistEvent.php

Environment

• EDR (formerly CB Response): All Versions
• Hosted EDR (formerly CB Response Cloud): All Versions
• App Control (formerly CB Protection): All Versions

Cause

This is because the authentication uses a different token to authenticate on the App Control side.

Resolution

Within App Control, navigate to System Configuration > Licensing > CB Response, and ensure the checkbox for "Receive Watchlist Events" is set.

Additional Information

• This solution covers the EDR to App Control integration (the "second" step of integration)
• The first step is App Control to EDR, which is well documented in the EDR Integration Guide.