EDR: Is there a real-time binary hash search feature?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Does EDR include a real-time hash scanning feature? 

Environment

• EDR: All Supported Versions

Resolution

No, EDR does not have a real-time or sensor-side scanner. All binary hashes are evaluated after they have been sent to the EDR server via the sensor check-in process.

Additional Information

Even though it's not "real time," most hashes will be scanned and evaluated as soon as they reach the EDR cluster. This will occur when a sensor checks in, which can be within a few minutes of it being seen by the endpoint.