Version
CB 4.2.x and 5.0.0
Issue
Unable to download a specific binary from the Carbon Black console
Symptoms
When trying to download a binary, you get this error:
Error 404 Not Found- The requested URL was not found on the server.
If you entered the URL manually please check your spelling and try again.
Cause
With the first option "Search binary hashes with VirusTotal" selected, but "Scan unknown binaries with VirusTotal" deselected in the sensor group settings, the Alliance server is not receiving the physical binary. With the additional option on the cb.conf file, "AllianceClientNoStorefileDelete=0", we are removing the binary from the server before reporting the hash to the Alliance, and the binary is then purged.
Solution
This is planned to be fixed in v5.0.1.
As a work around, please set the following on the cb.conf file:
AllianceClientNoStorefileDelete=1
KeepAllModuleFiles=1
This will save the files locally and you will start to have all of your data on the CB server.
Important Note(s)
Please be aware that this could potentially be a lot of data. Please check the 'MinAvailableSizeInMB' to make sure you limit the amount of data that will be stored before it starts to purge old data to make room for new binaries.
