Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How to Verify Connection to content.carbonblack.io (Windows)

Carbon Black Cloud: How to Verify Connection to content.carbonblack.io (Windows)

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard
    • Enterprise EDR
    • Audit & Remediation
    • Workload
  • Carbon Black Cloud Sensor: 3.6.0.x and Higher
  • Microsoft Windows: All Supported Versions

Objective

Provide steps for checking the connection from a local machine to the content delivery network (https://content.carbonblack.io) which provides additional configuration for 3.6.x.x and higher Sensors

Resolution

Via Live Response

  1. Start Live Response session with desired device
  2. Check connectivity
    execfg powershell Invoke-WebRequest -URI https://content.carbonblack.io
  3. Successful connection response is an error for missing Key-Pair-Id
    Invoke-WebRequest : MissingKeyMissing Key-Pair-Id query parameter or cookie value
    At line:1 char:1
    + Invoke-WebRequest -URI https://content.carbonblack.io
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
        + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Via Browser

  1. Open desired browser
  2. Go to https://content.carbonblack.io
  3. Successful connection response is an XML error for missing Key-Pair-Id
    This XML file does not appear to have any style information associated with it. The document tree is shown below.
    <Error>
    <Code>MissingKey</Code>
    <Message>Missing Key-Pair-Id query parameter or cookie value</Message>
    </Error>

Via Powershell

  1. Launch Powershell
  2. Run command to connect to https://content.carbonblack.io
    Invoke-WebRequest -URI https://content.carbonblack.io
  3. Successful connection response is an error for missing Key-Pair-Id
    Invoke-WebRequest : MissingKeyMissing Key-Pair-Id query parameter or cookie value
    At line:1 char:1
    + Invoke-WebRequest -URI https://content.carbonblack.io
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
        + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Via curl (Windows 10 17063 and above)

  1. Launch cmd.exe
  2. Run command to connect to https://content.carbonblack.io
    curl https://content.carbonblack.io
  3. Successful connection response is an XML error for missing Key-Pair-Id
    <?xml version="1.0" encoding="UTF-8"?><Error><Code>MissingKey</Code><Message>Missing Key-Pair-Id query parameter or cookie value</Message></Error>

Additional Notes

  • Since these tests are not being done using the authentication employed by the Sensor, they will fail in this way when there are no other network errors/issues
  • Misconfigured firewalls or proxies can present a number of different errors outside of the above, and should be investigated with your networking team

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-10-2021
Views:
1514
Contributors