Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Unable to download a specific binary in Carbon Black - "Error 404 Not Found"

Unable to download a specific binary in Carbon Black - "Error 404 Not Found"

Version

 

CB 4.2.x and 5.0.0

 

Issue

 

Unable to download a specific binary from the Carbon Black console

 

Symptoms

 

When trying to download a binary, you get this error:

Error 404 Not Found- The requested URL was not found on the server.

If you entered the URL manually please check your spelling and try again.

 

Cause

 

With the first option "Search binary hashes with VirusTotal" selected, but "Scan unknown binaries with VirusTotal" deselected in the sensor group settings, the Alliance server is not receiving the physical binary. With the additional option on the cb.conf file, "AllianceClientNoStorefileDelete=0", we are removing the binary from the server before reporting the hash to the Alliance, and the binary is then purged.

 

Solution

 

This is planned to be fixed in v5.0.1.

As a work around, please set the following on the cb.conf file:

AllianceClientNoStorefileDelete=1

KeepAllModuleFiles=1

 

This will save the files locally and you will start to have all of your data on the CB server.

 

Important Note(s)

 

Please be aware that this could potentially be a lot of data. Please check the 'MinAvailableSizeInMB' to make sure you limit the amount of data that will be stored before it starts to purge old data to make room for new binaries.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-11-2015
Views:
797
Contributors