CB Defense: When is the "Ignore" Reputation Applied?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

When is the "Ignore" reputation (i.e., highest trust level) applied to an application?

Environment

CB Defense Web Console: All Versions

Resolution

The "Ignore" reputation is assigned to CB Defense executables known to the sensor.  These may be:

• Hard-coded by path and running from within CB Defense self-protected folders
• Or use a locally verified code signature

Additional Information

• Full bypass permission for all operations will result in treatment similar to the "Ignore" reputation by the sensor.
• Bypass is tracked in parallel to reputation, so bypassed files will not technically be reported as having "Ignore" reputation.