Endpoint Standard: Adding self-signed cert to script and Configuring the system for a bypass.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Script is being blocked and adding the hash to reputation bypass list is not a manageable solution.

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard (was CB Defense)

Cause

Changes to script causes a new hash reputation causing Deny policy action

Resolution

1. Need to self-sign the script
2. Add root CA to local machines trusted root store
3. Create Cert Approval for the issuer in the console on the reputations page
4. Test on device to see if the cert is on the approval list 

   repcli querypolicy repconfig
   

5. Confirm the file in question has approval prior to running the test

   repcli find <filename>

Additional Information

Functionality was created for DSEN-17695