Carbon Black Cloud: Alert Indicates "Detected During Background Scan" Even Though Background Scan Has Completed
book
Article ID: 288596
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Why does an alert or event in the console sometimes report the message "... detected during background scan" for a new file file found on the machine - even though the sensor has been installed for a long time and the background scan has completed?
Environment
Carbon Black Cloud Console: All Currently Supported
Carbon Black Cloud Sensor: All Currently Supported
OS: All Currently Supported
Resolution
There are several different file flags that get processed when a new file has been detected on a system.
If the file is new (not found in local DB) and depending on the operation being performed the "...detected during background scan" label can sometime be applied by the console.
In most cases this will be attributed to the RepMgr64.exe process indicating the local sensor saw the file and made a reputation determination.