Carbon Black Cloud: How to determine if content.carbonblack.io is blocked?

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows Sensor: 3.6.x.x and Higher
• Microsoft Windows: All Supported Versions

Question

How to determine if content.carbonblack.io is blocked?

Answer

If content.carbonblack.io is blocked, the following symptoms will be observed:

• Enterprise EDR (was CB ThreatHunter) - Observe that sensor has not uploaded any data since upgrading to 3.6
• Device Control - Inability to block devices
• Checking RepCLI status output will display the following alarm: 

  C:\>"C:\Program Files\Confer\RepCLI.exe" status | findstr "ManifestDownloadFailure"
  
  ManifestDownloadFailure: x times LastTrigger[mm/dd/yyyy hh:mm:ss]

Additional Notes

• In sensor version 3.6.x.x and above, Enterprise EDR, AMSI Prevention, and Unified Binary Store must be able to access content.carbonblack.io in order to function correctly
• If a software or hardware firewall exists between the device and the internet, please ensure that outbound connections are allowed to content.carbonblack.io and inbound connections are allowed from content.carbonblack.io
• Device Control is available with Sensor 3.6.x.x and higher and Carbon Black Cloud Console November '20 Release (0.60) and higher

Related Content

Carbon Black Cloud: Is access to content.carbonblack.io required?
Carbon Black Cloud: What Ports must be opened on the Firewall and Proxy Servers?
Carbon Black Cloud: What’s the static IP address or hostname used by the back-end?
Carbon Black Cloud: What URLs are used to access the APIs?
Cb Defense: Sensor Will Not Register Or Receive Updates When Behind Proxy Or Firewall
CB ThreatHunter: What Ports must be opened on the Firewall and Proxy Servers?
CB Defense: What is the New Signature Update Server URL?