EDR: Is there a real-time binary hash search feature?
book
Article ID: 288093
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Does EDR include a real-time hash scanning feature?
Environment
EDR: All Supported Versions
Resolution
No, EDR does not have a real-time or sensor-side scanner. All binary hashes are evaluated after they have been sent to the EDR server via the sensor check-in process.
Additional Information
Even though it's not "real time," most hashes will be scanned and evaluated as soon as they reach the EDR cluster. This will occur when a sensor checks in, which can be within a few minutes of it being seen by the endpoint.