Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Attempting to delete the specific hash from all the endpoints does not delete the hash
Attempting to delete on the individual endpoint also fails
Attempted to delete by selecting "Take Action" drop down in the Endpoints tab and selecting "Delete application"
Application/Hash remains on device
Sensors reside behind a proxy
Audit Log shows
Hash - f5de9f13a3c4ac23510cde59a413fb9824e8548a853c5b7ab55dae123ded32a9 was requested to be deleted by [email protected] on device 12345 but no further actions are made.
Environment
CB Defense PSC Console: All Versions
CB Defense PSC Sensor: 3.2.x - 3.3.x
Microsoft Windows: All Supported Versions
Cause
There is an issue where the CB Defense sensor may fail to retrieve the hash delete list if using a proxy.
Resolution
Upgrade sensor to version 3.4.0.820 or higher where this issue if fixed
Attempt to delete hash once more
Confirm successful deletion by observing a message similar to the one below in the Audit Log
Success deleting hash 'f5de9f13a3c4ac23510cde59a413fb9824e8548a853c5b7ab55dae123ded32a9' off of device '12345678' at path '\Device\HarddiskVolume3\Windows\xx\10567837.exe'. Reason: SUCCESS