topic Re: Threat Hunting Authentication Failed in Endpoint

Threat Hunting Authentication Failed

RS_Daniel — Wed, 13 Mar 2024 22:20:41 GMT

Hello community,

We are working on a PoC for Harmony Endpoint with a possible customer. Everything is going well except for threat hunting. The endpoint is not sending any info to the portal.

On assets management we can see a Threat Hunting Error Description "Authentication Failed". Do you know what it means? Any possible solutions.

One thing to consider is that the machine works with explicit proxy. However at proxy level the endpoint has a permit any any rule. Is there any way to check specifically if threat hunting is able to upload info?

Doing a curl -proxy proxy_ip:8080 -v -k -X GET https://datatube-prod.azurewebsites.net/health runs succesfully on cmd.

Thanks in advance.

Regards

Re: Threat Hunting Authentication Failed

the_rock — Thu, 14 Mar 2024 00:48:43 GMT

Never seen that before and we have client that uses threat hunting. I would see if possibly your local SE person can open TAC case on your behalf to check this further.

But, lets see if someone else may have an idea.

Best,

Andy

Re: Threat Hunting Authentication Failed

AndrejMajer — Mon, 02 Dec 2024 10:40:22 GMT

Hello did you find solution for this?

Re: Threat Hunting Authentication Failed

_Val_ — Mon, 02 Dec 2024 13:27:19 GMT

I suggest you open a TAC request for this

Re: Threat Hunting Authentication Failed

RS_Daniel — Mon, 02 Dec 2024 17:21:03 GMT

Hello,

Yes, after some months working with RnD they provided a customer package that contains the fix for this issue. I was told that E88.70 will have the fix in GA, if you need it for an earlir version you will have to open a case with TAC.

Regards

Re: Threat Hunting Authentication Failed

the_rock — Mon, 02 Dec 2024 17:22:37 GMT

I heard some great things are coming with E89...fingers crossed!

Andy

Re: Threat Hunting Authentication Failed

AndrejMajer — Tue, 03 Dec 2024 07:19:13 GMT

Bro, the latest package is 88.61 😄 That means we need to wait for long time ? 😄