Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Response new Version 2 tokenization and query capability not working (immediately).

Cb Response new Version 2 tokenization and query capability not working (immediately).

Version
CB Response Server 6.1 or greater


Issue

The  6.1.x Cb Response Release Notes document new "Version 2" or "V2" tokenization/query capability

(See "Improved Command-line Searches" on page 10)

Carbon Black Response v6.1 - Release Notes

Symptoms

After following the steps documented (modifying the Master and each Minion's cb.conf and restarting services),

the new searching features do not immediately work.

For example, V2 tokenization now allows one to search for the string ".exe" as file extensions are now searchable fields as so:

cmdline:.exe

but this search will not return any results.


Cause
For V2 tokenization to take effect,

first the cb.conf files need the added line

CurrentEventsSchema=cbevents_v2

and only then will the next new "writer core" be created with that capability, and only new data ingested  in this core

will be accessible with the new V2 searching. Keep in mind that new writer cores are created every

three days, so V2 Tokenization can take up to 3 days before it takes effect.

For example,  if an administrator edits all the cb.confs for each Cb server on Monday,

it may take until up to Thursday until all  new writer cores are created on all servers that will support V2 Tokenization.

The way to verify a core now supports v2 tokenization is to look at the text file

/var/cb/data/solr5/cbevents/cbevents_(date)/core.properties

and check the value for this line:

configSet=cbevents_v2

This means any events injested into this core will be searchable with the new capabilities.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-21-2017
Views:
901
Contributors