Carbon Black Cloud: Can SHA1 Hashes be added to the Approved or Banned List?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Can SHA1 hashes be added to the Banned or Approved?

Environment

• Carbon Black Cloud Console: All Versions

Resolution

No, the CBC currently only supports the ability to add SHA256 hashes to the Approved or Banned lists.

Additional Information

• Searching for the SHA1 hash on VirusTotal can provide the SHA256 for the same file. Not every file has both hashes listed. 
• If the file exists on an endpoint, the following article covers how to get the SHA256 hash: https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-get-a-SHA-256-hash-of-a-file-on-Windows-and/ta-p/46183