CB-Defense-Delete-Hash-From-Endpoint-Not-Completing

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Attempting to delete the specific hash from all the endpoints does not delete the hash
• Attempting to delete on the individual endpoint also fails
• Attempted to delete by selecting "Take Action" drop down in the Endpoints tab and selecting "Delete application"
• Application/Hash remains on device
• Sensors reside behind a proxy
• Audit Log shows

  Hash - f5de9f13a3c4ac23510cde59a413fb9824e8548a853c5b7ab55dae123ded32a9 was requested to be deleted by [email protected] on device 12345 but no further actions are made.

Environment

• CB Defense PSC Console: All Versions
• CB Defense PSC Sensor: 3.2.x - 3.3.x
• Microsoft Windows: All Supported Versions

Cause

There is an issue where the CB Defense sensor may fail to retrieve the hash delete list if using a proxy.

Resolution

1. Upgrade sensor to version 3.4.0.820 or higher where this issue if fixed
2. Attempt to delete hash once more
3. Confirm successful deletion by observing a message similar to the one below in the Audit Log

Success deleting hash 'f5de9f13a3c4ac23510cde59a413fb9824e8548a853c5b7ab55dae123ded32a9' off of device '12345678' at path '\Device\HarddiskVolume3\Windows\xx\10567837.exe'. Reason: SUCCESS