CB Defense: Why does confer log show "blocked from network" even when sensor is in bypass mode

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does confer log show "blocked from network" even when sensor is in bypass mode?

Environment

CB Defense PSC Sensor: All versions

Resolution

"is blocked from the network" is an indicator of the policy for a hash/path that has been calculated based on policy rules. The reputation of the particular hash/path combined with the policy rules has determined that this hash/path will be blocked if it tries to make a network connection when the sensor is not in bypass. Putting the sensor in bypass does not cause this policy to change, it just determines whether the sensor observes the calculated policy."