Endpoint Standard: Prior to Implementing a Rule, Could TTPs Confirm Which Applications Will be Blocked?
book
Article ID: 285491
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Could the use of TTPs confirm which applications will be blocked prior to implementing a rule?
Environment
Endpoint Standard: All Versions
Resolution
No. TTPs do not determine which policy rules will be applied, so TTPs cannot guarantee a certain policy action would occur.
Additional Information
Queries can be run on the Investigation page for TTPs which typically surface when certain policy rules are applied to applications with a specific reputation or name/path.
TTPs are NOT correlated to Blocking and Isolation operations.