EDR: Sensor not checking in behind firewall

[#1]

Environment

• EDR (formerly Cb Response) Server: All Versions
• EDR Sensor: All Linux Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions

Symptoms

Sensor logs show communication HRESULT - 0x80cc006e or 0x80072F8F

Cause

The firewall configuration is preventing the sensor from contacting the sever.

Resolution

• Firewall configuration changes must be made to allow the sensor to communication with unaltered certificates including
  • The default sensor communication port, 443.
  • The IP address or FQDN of the back-end server

Additional Notes

• If the sensor communication port has been changed in nginx, then that port will need to be opened instead of 443. 

Related Content

• Hosted EDR: How to Find the IP Address of a Cloud Server
• CB Response: How to Translate the CB Sensor Communication Error Code (HRESULT)
• CB Response: What are the common sensor communication error messages? (HRESULT)
• CB Response: Sensors checking in intermittently (0x8007274c)
• CB Response: Windows Sensor log error: "HRESULT 0x80072747"
• CB Response: Sensorcomms.log shows HRESULT error 0x80c80006 for eventlog upload attempts
• CB Response: Sensor logs to collect for general troubleshooting
• https://docs.microsoft.com/en-us/windows/desktop/winsock/windows-sockets-error-codes-2