Samba Shares Unavailable in Azure UEB

SUMMARY

Samba shares may become unavailable in UEB appliances deployed in Azure.

ISSUE

Samba shares may become unavailable in UEB appliances deployed in Azure. 

RESOLUTION

To correct this issue, follow the steps below to reboot your appliance:

1. From the appliance UI, Click on the Configure tab.
2. Select your appliance.
3. Click on the Edit button. 
4. In the Edit Appliance window, click on the General tab. 
5. In the bottom-left corner of the window, click on the Shutdown/Restart button.

CAUSE

The issue is caused by a communication failure between Microsoft's Azure agent and the Azure network. This communication failure results in an invalid IP address being set on the eth0 interface, which causes the smbd (Samba) service to crash. Rebooting the appliance allows the Azure agent to re-establish communication and receive a correct IP address.