Reporting Malware False Positives to Symantec Carbon Black

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black EDR (formerly Cb Response)
• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

If hash is classified as malware, but it is a trusted file, how should this be reported?

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• App Control: All Versions
• EDR: All Versions

Resolution

Please submit a file to the Symantec Security Response portal for review.

Additional Information

• A Technical Support case will no longer be necessary to report false positives and false negatives.
• The Symantec Security Response portal eliminates the need for customers to open a Support ticket and is intended to provide a more streamlined experience.