Check Carbon Black File Reputation Status and Connectivity

Products

• Carbon Black App Control

Issue/Introduction

To confirm Carbon Black File Reputation (Formerly CDC / SRS) status and connectivity.

Environment

• App Control Server: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Verify Activation & Status:

1. Login to the Console and navigate to System Configuration > Licensing > Carbon Black File Reputation Activation.
2. Verify the subscription to Carbon Black File Reputation shows as "Currently activated".
3. Click Options to load the Settings page.
4. Verify "Enable file metadata sharing for Reputation and Threat results from Carbon Black" is checked.

Test Connectivity:

1. Log in to the application server hosting the Console as the Carbon Black Service Account.
2. Open an administrative command prompt and issue the following commands:

   cd "C:\Program Files\Bit9\Parity Server\Reporter"
   ParityReporter.exe check
   
   Note: If an Agent is installed on the App Control server, Tamper Protection may need to be temporarily disabled before using the ParityReporter command.
   

3. Test the connection to Port 443 via PowerShell:

   tnc -ComputerName services.bit9.com -Port 443 -InformationLevel "Detailed"

4. Run the following query in SQL Server Management Studio (SSMS):

   use DAS; SELECT name, value FROM dbo.shepherd_configs WHERE name in ('ParityServerVersion', 'ActivationState', 'ActivationVerified', 'ActivationKey', 'ParityCenterSIDHash', 'ReporterConnectivityError')

If connectivity issues persist, despite successful tests:

1. Confirm you're on a version with a non-expired certificate.
2. Collect Server High Debug Logs and a Wireshark capture while recreating the connectivity tests if the issue still occurs

Additional Information

• The connection between Carbon Black File Reputation and the application server hosting the Console will require TLS 1.2.
• To initiate the connection with the Carbon Black File Reputation.NET 4.6.2 (or later) is recommended. Earlier versions of .NET will default to pre-TLS 1.2 protocols, which will prevent a connection.
• The Carbon Black File Reputation Key is different than the App Control License Key (.lic file), but should be included when the License Key is provisioned.
• The Reputation Key is unique, and directly associated with the unique License Key. It should not be used on multiple App Control Servers.