EDR: Is It Possible To Search For a PDF Or Excel File By Hash To Find What Endpoints The File Is On?
search cancel

EDR: Is It Possible To Search For a PDF Or Excel File By Hash To Find What Endpoints The File Is On?

book

Article ID: 287174

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is it possible to search for a PDF or Excel file by hash to find what endpoints the file is on using EDR?

Environment

  • EDR Server: All Versions

Resolution

No, PDF and Excel files are not tracked by EDR, and would not show in the console upon search.

Additional Information

  • EDR will only collect binaries that execute; it does not collect scripts, batch files, or computer files that are created or modified.
  • App Control is the more suitable product to find files by hash.