Live Response API fails to download large files

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Live Response API large file transfers (downloads) are failing. The first attempt fails with a file containing "code 201" for any file size. The second attempt to download the same file is successful for smaller files. For the large file > 900MB, the Live Response API is unable to download the file even on the second try.

Environment

• Carbon Black Cloud Enterprise EDR: Current Version
• Carbon Black Cloud Endpoint Standard: Current Versions
• Carbon Black Cloud SDK: Version 1.5.5 and Lower

Cause

Defect was found in the Carbon Black Cloud SDK where the get_raw_file() function in src/cbc_sdk/live_response_api.py was always returning `None` when command_id=0

Resolution

Defect (DSER-50836) was fixed and is available in Carbon Black Cloud SDK v1.5.6.

Additional Information

• Release Notes
• Github Notes
• Carbon Black Cloud SDK Package
• ReadTheDocs
• Developer Network Blog Post