Process shows Unknown Certificate and the name of Signee on Certificate

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• Event Details panel show Hash as Unknown and with name of Certificate Signee

Environment

• Carbon Black Cloud Console

Cause

It is possible for the Console to have values of sign_state as "unknown" but the Hash have signedBy assigned by the Cloud with a value

Resolution

This is expected if the sensor only has the signed by value but the signed state is unknown

Additional Information

Values for determining displayed data of Certificate values

• Signed: (sign_state: "signed"  OR signed: true )
• Not Signed: (signed: false  )  
• Unverified: (NOT sign_state: "verified"  OR signedBy:null ) 
• Unknown: (sign_state: "unknown"  )