Endpoint Standard: Why does CBC Sensor not automatically update a hash's value?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does CBC Sensor not automatically update a hash's value?

Environment

• Carbon Black Cloud Sensor: All Versions

Resolution

The CBC Sensor does indeed automatically update the hash values but it can take time. 

Additional Information

The Sensor has a Database to cache the values and speed up performance. As hashes with a reputation are seen a Time to Live "TTL" is associated with the hash and the source. These values can be ignored by placing a hash in the Console for a Reputation Bypass. If you only have a system or two with the cached value and the reputation has been resolved and flushed at the Org level then you can flush it locally on the system.