EDR: Can Already Running Processes be Ingress Filtered?
book
Article ID: 285691
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
Can an already running process be filtered by an ingress filter?
Environment
EDR Server: All Versions
Resolution
No, an already running process GUID has been added to a cache as a "non-filter" to enhance performance and will continue to be allowed.
Additional Information
For on-prem customers a restart of cb-datastore service will clear the cache and can be built up.
When using descendent filtering, if a process is filtered and does not do anything new to be added to the cleared cache, the descendents will continue to be not be filtered.
CB-37587 has been created to enhance the ingress filter by clearing the cache to reset any matches that are listed as 'non-filtered' previously.