EDR: How to find a Hash in UI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Find information related to a Hash in UI

Environment

• EDR: All Supported Versions

Resolution

There are multiple ways to find a hash from UI:

•  Binary search with MD5 
  1. On the binary search page, click on +Add Criteria button on the top left side of the page 
  2. Select MD5 from the list of Primary Criteria and enter the hash to search
  3. Select Update

 

• Process search with MD5:
  1. On the process search page, click on +ADD SEARCH TERMS
  2. Select hash > MD5 of exe, binary or file from the choose criteria dropdown

3. Select Add Terms 

 

• Banned Hashes Page
  1. On the Banned Hashes page, select + Ban more hashes
  2. Add the MD5s to be banned in the pop-up
  3. Select Ban Hashes
  4. On the confirmation page, click on drop down button next to computers it was found on.