Endpoint Standard: What do the Different Options Mean for On-Access File Scan Mode?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What do the different options for On-Access File Scan Mode mean?

Environment

• Endpoint Standard Console: All Versions
• Endpoint Standard Sensor: All Versions

Resolution

The three options for On-Access File Scan Mode are:

• Disabled - No scanning of files occurs
• Normal - Scans new files (exes, dlls, scripts) on the first execute of that file (determined by hash).
• Aggressive - Scans all files on execute. The assigned reputation and policy rules apply.