Search the Vendor's database for md5 hash being seen
The md5 hash is not in the list
Environment
EDR Server: 7.5.0-svr and Higher
EDR Sensors: All versions
CB Threat Feed: Abuse.ch
Cause
There is an issue with the CB Abuse feed that, once an MD5 hash is registered, it will not be removed, even though the hash is removed from Abuse.ch source at the feodotracker site.
Resolution
This can be worked around by editing the /etc/cb/cb.conf (just the Primary on a cluster will do) and adding this line:
IgnoreTimestampOnFeedUpdate=true
and restarting the cluster services.
Additional Information
If the hash being seen is on the vendor's malware list then the alert should be responded to