Carbon Black Cloud: Alert Indicates "Detected During Background Scan" Even Though Background Scan Has Completed
search cancel

Carbon Black Cloud: Alert Indicates "Detected During Background Scan" Even Though Background Scan Has Completed

book

Article ID: 288596

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does an alert or event in the console sometimes report the message "... detected during background scan" for a new file file found on the machine - even though the sensor has been installed for a long time and the background scan has completed?

Environment

  • Carbon Black Cloud Console: All Currently Supported
  • Carbon Black Cloud Sensor: All Currently Supported
  • OS: All Currently Supported

Resolution

  • There are several different file flags that get processed when a new file has been detected on a system.
  • If the file is new (not found in local DB) and depending on the operation being performed the "...detected during background scan" label can sometime be applied by the console.
  • In most cases this will be attributed to the RepMgr64.exe process indicating the local sensor saw the file and made a reputation determination.