Endpoint Standard: Prior to Implementing a Rule, Could TTPs Confirm Which Applications Will be Blocked?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Could the use of TTPs confirm which applications will be blocked prior to implementing a rule?

Environment

• Endpoint Standard:  All Versions

Resolution

No.  TTPs do not determine which policy rules will be applied, so TTPs cannot guarantee a certain policy action would occur.

Additional Information

• Queries can be run on the Investigation page for TTPs which typically surface when certain policy rules are applied to applications with a specific reputation or name/path.
• TTPs are NOT correlated to Blocking and Isolation operations.