EDR: Tamper Detection Alerts Being Received When Sensors Do Not Have Tamper Detection Enabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Tamper detection alerts being received in EDR UI when sensors do not have Tamper Detection enabled.

Environment

• EDR Server: 7.4.0 and Higher
• EDR Sensor: 7.2.0 and Higher

Cause

The cbtamper Threat Intel Feed is enabled, which is generating the alerts shown in the EDR UI.

Resolution

Disable the cbtamper Threat Intel Feed:

1. In EDR UI, Go To "Threat Intelligence" section of UI.
2. Find "Tamper Detection" threat intelligence feed panel.
3. Uncheck box for "Enabled" to disable the feed.

Additional Information

Do not disable this feed without first discussing the ramifications thereof with the SOC.