Carbon Black Cloud: Sensor Interop Issue With Caliper Maptitude

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Maptitude application crashes upon launch when the sensor is active.
• Maptitude functions normally when the sensor is in Bypass.

Environment

• Carbon Black Cloud Console
• Carbon Black Cloud Sensor: All Supported Versions
• Caliper Maptitude

Cause

Interop issue between Maptitude and Carbon Black Cloud Sensor.

Resolution

Create a policy permission rule to Allow Maptitude: 

1. Identify the paths that are being affected or blocked by the sensor. The paths should be related to SSCProt.exe and KeyActivateWizard.exe.
2. Log in to the Carbon Black Cloud Console.
3. Navigate to Enforce > Policies > Relevant Policy > Prevention.
4. In the Permissions section, click "Add file path" and add the File paths that were identified in Step 1.

   <pathto>\SSCProt.exe
   <pathto>\KeyActivateWizard.exe

   Note: Wildcards allow the path to be more dynamic however more specific paths may increase security posture. 
5. For the Operation Attempt > Performs any API Operation > enable: Bypass.
6. Confirm the changes made.
7. Save the policy changes.

 

Additional Information

• Allow listing and path exclusions are also suggested by Caliper for Maptitude found here.