CB Response: Unable To Ban Hash If Duplicate Hash Selected
book
Article ID: 287855
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Attempting To Ban MD5 Hash Or Hashes
Receive Error Message That Hashes Are Unrecognized
Hashes Do Not Appear On Banned List If Duplicate Hash Listed
Environment
Carbon Black Response Console: All Versions
Carbon Black Response Server: All Versions
Cause
Current limitation in the product where the UI does not do any check as to whether the list contains any duplicates. There is one call made to the banning API per hash. This means that although each unique hash does get banned successfully, the calls for duplicate hashes fail.
Resolution
This will be resolved in a future product release.