Carbon Black Cloud: Is banning available on individual sensor basis?
book
Article ID: 285431
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Can you ban applications on a per sensor basis?
Environment
Carbon Black Cloud Sensor: All supported Versions
Carbon Black Cloud Console: All versions
Microsoft Windows: All Supported Versions
Apple MacOS: All Supported Versions
Resolution
You can add the application or path to an existing policy by creating a blocking rule for Runs or is running to Terminate Process. See the example below:
Application(s) at path:
powershell.exe
Operation attempt:
Runs or is running
Action:
Terminate process
Additional Information
There is an open feature request to have this added into the product here: https://community.carbonblack.com/t5/Idea-Central/CB-Defense-Ability-to-blacklist-applications-per-sensor/idi-p/70616#M7861