CB Defense: Notifications Not Shown in Local Sensor UI

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

A Deny or Terminate action is not shown in the local sensor UI.

Environment

• CB Defense Sensor: Version 2.x and Higher
• CB Defense Sensor UI
• CB Defense Web Console: All Versions

Cause

Sensor UI notifications for Network Operations (e.g., TCP or UDP connection) and API Calls (e.g., code injection, memory scrape, etc.) are not shown due to the intent of reducing pop-up fatigue.

Resolution

Search for the Deny or Terminate operation on the Investigate page within the CB Defense Web Console.

Additional Information

• Process operations that are reported to the sensor UI include Process Create, File Actions, and Malware found by the local scanner.
• Submit a Carbon Black support case if the notification does not include Network Operations or API Calls and is, in fact, missing from the sensor UI.