CB Response: How To Alert On Hashes Listed On Managed Banned Hashes Page Whose Bans Are Disabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to alert on hashes that are listed on the Managed Banned Hashes page whose bans are disabled, and therefore allowed to execute.

Environment

• CB Response Server: 6.x

Resolution

1. Login to the CB Response UI
2. Go to the "Managed Banned Hashes" page.
3. Highlight and copy the hash of interest in the banned hashes list.
4. Go to the "Process Search" page in the CB Response UI.
5. In the query field, type "md5:" followed by the hash of interest.
6. Run the query.
7. Click the "Create Watchlist" button above the results to create a watchlist based on this query.
8. Verify the "Create Alert" box is checked for this watchlist.