Carbon Black Cloud: Where is the DNS Suffix check performed on devices?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Is the DNS Suffix check performed on the network adaptor or does it check the DNS Suffix value in the system settings of the device? 

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

The DNS Suffix check is performed on the network adaptor of the device.

Additional Information

• Inside the corporate network (On Premises), the device will get the DNS Suffix entered in the “Settings > General” page
• When the device connects to a different network (Off Premises), such as at home, its DNS Suffix is modified or cleared, so it doesn’t match any DNS Suffix listed in “Settings > General”
• DNS Suffix only modifies the “On-Premises/Off-Premises” value for the events/alert triage/process tree and the Local AV Scanner signature update URL chosen in the Policy page
• Policy assignment, Policy Rule enforcement, and Sensor installation success or failure is not impacted by the DNS Suffix setting