EDR: Banned Hashes Are Still Allowed to Run

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Banned hashes are being ran even after being banned

Environment

• EDR Sensor: All Supported Versions
• EDR Server: All Supported Versions

Cause

• This can happen if the option "Process Banning" is not enabled in the sensor group

Resolution

1. Go to Sensors -> Required Sensor Group -> Settings -> Advanced
2. Check "Process Banning"