"uDisk" USB devices experience serial number corruption (changing, unusual characters, entirely missing) that prohibit USB approval process via serial numbers.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

1. Inventory -> USB DEVICES lists devices with the PRODUCT value "uDisk" 
2. The SERIAL NUMBER is either missing, or has unusual characters like Љ <- Љ ‎(upper case, lower case љ ... the fourteenth letter of the Serbo-Croatian Cyrillic alphabet)
3. The SERIAL NUMBER may change after ejecting and reinserting.

Environment

• Carbon Black Cloud Sensors: All versions
• Carbon Black Cloud Console: All versions
• Sensor Operating Systems: All versions
• "USB" devices: uDisk

Resolution

The "uDisk" designation is a sign of a problem between the device and the Operating System (e.g. occurs without the Carbon Black Cloud sensor in the picture)

From this article

"If your USB flash drive mounts as a UDISK on your computer, it means it’s a bad USB drive with firmware that doesn’t match the memory type and controller combination. The drive is saying it’s using flash memory, when in reality it’s just a small hard drive. Without the correct firmware in the controller, the USB stick is unstable and the operating system tips users about the problem by calling it a UDISK."