Threat Hunting Authentication Failed

[RS_Daniel]

Hello community,

We are working on a PoC for Harmony Endpoint with a possible customer. Everything is going well except for threat hunting. The endpoint is not sending any info to the portal.

On assets management we can see a Threat Hunting Error Description "Authentication Failed". Do you know what it means? Any possible solutions.

One thing to consider is that the machine works with explicit proxy. However at proxy level the endpoint has a permit any any rule. Is there any way to check specifically if threat hunting is able to upload info? 

Doing a curl -proxy proxy_ip:8080 -v -k -X GET https://datatube-prod.azurewebsites.net/health runs succesfully on cmd.

Thanks in advance.

Regards

[the_rock]

Never seen that before and we have client that uses threat hunting. I would see if possibly your local SE person can open TAC case on your behalf to check this further.

But, lets see if someone else may have an idea.

Best,

Andy

[AndrejMajer]

Hello did you find solution for this?

[RS_Daniel]

Hello,

Yes, after some months working with RnD they provided a customer package that contains the fix for this issue. I was told that E88.70 will have the fix in GA, if you need it for an earlir version you will have to open a case with TAC.

Regards

[the_rock]

I heard some great things are coming with E89...fingers crossed!

Andy

[AndrejMajer]

Bro, the latest package is 88.61 😄 That means we need to wait for long time ? 😄

[_Val_]

I suggest you open a TAC request for this