EDR: Banned Hashes Page Only Shows 500 Hashes
search cancel

EDR: Banned Hashes Page Only Shows 500 Hashes

book

Article ID: 285463

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Banned hash count of 500 or more
  • Banned Hashes page displays only 500 for the count

Environment

  • EDR Server: All versions
  • RHEL: All supported versions
  • CentOS: All supported versions

Cause

  • The web UI only displays 500 hashes and is not paginated.

Resolution

There are two workarounds to retrieve a full list of current actively banned hashes

  1. Perform the following SQL query via SSH:
psql cb -p 5002 -c "SELECT * from banning_blacklist"
  1. ​​​​Leverage the Cb Response API:
https://<Servername>/api/v1/banning/blacklist?count=10000"

 

Additional Information