EDR: Sensor Modification Requires DUO Authentication

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Moving sensors to a new group or modifying sensors require DUO authentications.

Environment

EDR: All versions

Cause

This is a known bug CB-34129

Resolution

• This bug will be fixed in a future release.
• Temporary workaround:

1. Make the following modification:

sudo vi /usr/share/cb/plugins/duo/duo_2fa_auth_callback.py

Change line

sensor_re = re.compile(r"/api/v(\d+)/sensor/(\d+)")

TO

sensor_re = re.compile(r"/api/v([23456])/sensor/(\d+)")

2. Restart services: 

https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294