Carbon Black Cloud: Last Check-In Not Updating And Live Response Button Is Gray For Active Sensors

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Audit & Remediation (was CB LiveOps)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Version

Symptoms

• Sensor status shows as Active on the Endpoints page
• Last Check-In date and time not updating or taking longer to update for Sensor(s)
• Go Live (Live Response) button is grayed-out for the Sensor(s)
• Current Events showing on the Investigate page for the Sensor(s)
• Sensor installed and running on endpoint

Cause

Under investigation

Resolution

Carbon Black is working on creating a permanent fix for this issue and a fix will be made available as soon as we're able.

Temporary Workaround

1. Log into Console
2. Go to Endpoints page
3. Find device by name and expand Endpoint details
4. Copy Device ID
5. Use the following URL to manually start a Live Response session

   https://<DashboardURL>/live-response/<device_id>
   
   Example
   https://defense-prod05.conferdeploy.net/live-response/123456
   

Additional Notes

• Replace all items enclosed in <> with actual values, including <> (i.e., <device_id> becomes 123456)
• To verify that sensors are checking in correctly follow these steps
  1. Go to the Endpoints page
  2. Search for the desired Device Name
  3. Click on the Device Name (hyperlink) to be redirected to the filtered Investigate page for the selected Device
  4. Review the Events on this page to verify their date and time are recent (within the last 5-10 minutes)

Related Content

Command-line syntax key