MVISION EDR | on-premise | DXL DataBusCloud Unable to send batch, no authorization token

[tonysssbear]

Hi Everyone,

I have an MVISION Tenant, which integrated to On-premise ePO

But there are no traces received by MVISION ePO

I can find ePO connection is success on "support" page, but no trace received

ePO show "This server is linked " on Server Setting

And I can find an error "DataBusCloud Unable to send batch, no authorization token" on DXL

May anyone know what I can do now?

p.s. version

- ePO: 5.10 patch 15

- agent, 5.7.8

- EDR: 4.1

- DXL 6.0 (Install in ePO server)

p.s.s: what I have try

1. Reinstall Cloud Bridge -> same error

2. Install another EDR agent -> same error

3. uninstall all EDR extension on ePO and reinstall -> same error

Regards

Tony

[Pravas]

Hi @tonysssbear ,

Trellix EDR doesn't support SSL inspection. Please ensure its switched off for DXL server.

Please also run EDR test file as mentioned in the link below.

https://kcm.trellix.com/corporate/index?page=content&id=KB93745&actp=null&viewlocale=en_US&showDraft...

Thanks

[tonysssbear]

Hi Pracas,

How can I know SSL is enabled? How to turn it off?

BTW, I cannot find any device on "real time search" and " device Search", maybe it is not sampling issue

On ePO, EDR is enabled and hashing is processing, full monitor policy is using

Regards

Tony

[Abdel]

what was your solution for this  problem  ? 

[tonysssbear]

In my case, NTP need to be set and ePO server need to be reboot

It is better to seem support help or regenerate a new tenant as a try

Sometime, geolocation  different have different behaviors