Carbon Black Cloud: How to Troubleshoot Connector or API Issues

[#1]

Environment

• Carbon Black Cloud Console:  All supported Versions

Objective

How to troubleshoot connector or API issues

Resolution

Review configurations in the Carbon Black Cloud console to confirm the selections/information entered are correct:

1. Connector type
2. Connector ID
3. API Key
4. Notifications have been forwarded to the SIEM
5. Notifications have been assigned to the correct policy
6. Notifications have been subscribed to the connector

Also check for debug logs as noted in the Developer page:

https://developer.carbonblack.com/reference/cb-defense/connectors/#debug-logs
 

Additional Notes

Common causes for API/Connector Issues

1. <Response [401]> Error
2. Authorized IP Field
3. REST API Not handling Multi-Byte text properly
4. Connector not connecting - URL
5. Error: Output_Format not Specified
6. Not using connector type SIEM

Related Content

https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/integrations/
Cb Defense: What firewall ports need to be open for the SIEM Connector?
Cb Defense: What type of IP Addresses can be used for SIEM Connectors?
Cb Defense: What does a Sample Syslog Output look like?
Cb Defense: SIEM/API Error: output_format of json or cef must be specified
CB Defense: What are the Compatible Output Formats for the Syslog Connector?