What happens when a Device is placed in Quarantine?

search cancel

book

calendar_today

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

The network filter driver blocks all incoming/outgoing TCP traffic to any IP/ports except for those used to maintain a connection to the Carbon Black Cloud Console
Devices will still be able to check in with the Carbon Black Cloud Console for devices status changes. i.e. Switch from Quarantine to Active

Quarantine mode allows both CB Support and Carbon Black Cloud Administrators to continue investigating a device from the Carbon Black Cloud Console (Investigate Page, Live Response, Live Query, etc..) while reducing the risks involved with allowing a compromised device to access the local network
CB Support will still be able to to pull sensor logs from the device while in quarantined mode

Windows & Mac: All UDP connections except for those responsible for DNS requests, UDP/53, and DHCP, UDP/67 & UDP/68, will be blocked
Linux: All UDP connections except for those responsible for DNS requests i.e. UPD/53 and for DHCP requests i.e. UDP/67 & UPD/68 (for ipv4) and UDP/546 & UDP/547 (for ipv6), will be blocked.
DNS/DHCP is allowed to ensure the bilateral communication between the Carbon Black Cloud Console and the quarantined device
ARP is allowed to ensure MAC addresses can resolve to to IP addresses
ICMP (ping) is allowed
Quarantine terminates active sockets that aren't exempt from Quarantine; effectively re-authorizing any existing connections
Windows Filtering Platform API is used to determine traffic type per connection on Windows
The types of connections, remote investigation, or remediation tools that are allowed and disallowed in quarantine mode cannot be customized

thumb_up Yes

thumb_down No