Collect-Forensics Playbook Failed on Carbon Black Endpoint

Issue

A Threat is published in your Red Canary.  The Collect-Forensics Playbook action fails when executed in parallel (i.e, at the same time) with the Isolate Playbook action.

Environment

Red Canary Automation + Carbon Black Cloud

Resolution

A "Collect-Forensics" Playbook action will fail if the endpoint is Isolated before or during the Forensic collection process. Once a Carbon Black endpoint is Isolated, it loses the network connectivity required for the Collect Forensics Package Playbook to run.

If your playbook is configured to run Isolate and Collect Forensics simultaneously (in parallel), the isolation will terminate the forensics connection

Example: The incorrect parallel configuration shown below triggers both actions at once, leading to failure.
NOTE: Even if the "Collect-Forensics Package" action was placed above the "Isolate the Endpoint" action, these will still both be run at the same time and risk isolating the Endpoint. 

To resolve this, you must configure your playbook to run these actions sequentially rather than in parallel.

1. Ensure Collect-Forensics completes successfully before the Isolate action begins.

2. Adjust your playbook logic to set the "Isolate the Endpoint" action below the check mark (i.e below the "When all actions successfully complete " section).  See screenshot below

Example: This is what that the correct setup would look like: 

Cause

Carbon Black Isolation severs the network connection required for Forensic data collection. If these actions are scheduled to run at the exact same time in your Playbook:

• The Isolate action often completes first or interrupts the Collect Forensics process.

• The communication link is broken, causing the forensics task to time out or error.