Endpoint Standard: Can I Change the Background Scan Type After It Starts?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Can I change the background scan type after it starts?

Ex:
Scan is currently running as Standard but I want it to run as Expedited

Environment

• Carbon Black Cloud Sensor: 3.3.x
• Microsoft Windows: All Supported Versions

Resolution

Yes, the type can be changed within Enforce > Policies > Click Policy > Sensor Tab > "Run Background scan" section. The next time the sensor checks in, it will change from whatever type is currently running, to it's new type.

Additional Information

Changing the policy setting will effect all devices in the policy. If another setting is needed for specific endpoint(s) the recommendation would be to create a new policy with the desired setting.