CB Defense: IT_TOOL Whitelist Reputation Not Applied

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Child processes are not being labeled with appropriate reputation even though the IT_TOOL is whitelisted appropriately and IT_TOOL starts with drive letter and is correctly configured for child processes to be granted Local_White Reputation

Environment

• CB Defense PSC Console: All Supported Versions

Cause

IT_TOOL paths beginning with drive letter not matching correctly

Resolution

This issue is corrected in versions 3.4 and greater under the Release note: DSEN-4566
Workaround for earlier versions available using wildcards: *\path\process.exe