EDR: Is It Possible To Search For a PDF Or Excel File By Hash To Find What Endpoints The File Is On?
book
Article ID: 287174
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Is it possible to search for a PDF or Excel file by hash to find what endpoints the file is on using EDR?
Resolution
No, PDF and Excel files are not tracked by EDR, and would not show in the console upon search.
Additional Information
- EDRÂ will only collect binaries that execute; it does not collect scripts, batch files, or computer files that are created or modified.
- App Control is the more suitable product to find files by hash.
Feedback
thumb_up
Yes
thumb_down
No