Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Starting Live Response Session on New Linux Sensors Results in Status Code 403

Carbon Black Cloud: Starting Live Response Session on New Linux Sensors Results in Status Code 403

Environment

  • Carbon Black Cloud Console: All supported versions
  • Carbon Black Cloud Linux Sensor: All supported versions
  • RHEL/Cent OS: All supported versions
  • Ubuntu: All supported versions
  • SUSE: All supported versions
  • Amazon Linux: supported versions

Symptoms

  • Linux Sensor is successfully installed
  • Sensor checks in and is connected to the Carbon Black Cloud Console
  • Selecting the "Go Live" option for this Sensor results in an error with Status Code 403

Cause

The policy applied to this Sensor does not have Live Response enabled

Resolution

Move the Sensor to an existing or new policy with LR enabled

Additional Notes

  • The default policy for a Sensor is the Standard policy
  • The Standard policy has LR disabled by default

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-26-2019
Views:
872
Contributors