Carbon Black Cloud: JSON Format Reputation Mapping

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What is the JSON Format Reputation Mapping in Carbon Black Cloud?

Environment

• Carbon Black Cloud: All supported Backend versions

Resolution

Company White (Approved List) = REP_COMPANY_WHITE
Company Black (Banned List) = REP_COMPANY_BLACK
Trusted White = REP_WHITE
Known Malware = REP_KNOWN_MALWARE
Suspect/Heuristic Malware = REP_SUSPECT_MALWARE / REP_HEURISTIC
Adware/PUP Malware = REP_ADWARE / REP_POTENTIALLY_UNWANTED_APP
Local White = REP_LOCAL_WHITE
Common White = REP_COMMON
Not Listed/Adaptive White = REP_NOT_LISTED
Unknown = REP_RESOLVING

Additional Information

The JSON format reputation can be found in places like CBC connector logs.