EDR: Banned Hashes Are Still Allowed to Run
book
Article ID: 287743
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Banned hashes are being ran even after being banned
Environment
- EDR Sensor: All Supported Versions
- EDR Server: All Supported Versions
Cause
- This can happen if the option "Process Banning" is not enabled in the sensor group
Resolution
- Go to Sensors -> Required Sensor Group -> Settings -> Advanced
- Check "Process Banning"
Feedback
thumb_up
Yes
thumb_down
No