EDR: Netconns showing for a process that should not have netconns
book
Article ID: 285951
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Netconns are showing for processes that should not have netconn attempts like cat, grep, sed, etc.
Environment
- EDR Sensor: All Versions
- Linux: All Versions
- macOS: All Versions
Cause
Another process is calling multiple fork executes using the same process id
Resolution
CB-21348 has been created to add start time to the sensor checks for pids in order to split the behavior
Additional Information
- Please subscribe to this article for updates and expected fix version
Feedback
thumb_up
Yes
thumb_down
No