Carbon Black Cloud: Alert Indicates "Detected During Background Scan" Even Though Background Scan Has Completed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why does an alert or event in the console sometimes report the message "... detected during background scan" for a new file file found on the machine - even though the sensor has been installed for a long time and the background scan has completed?

Environment

• Carbon Black Cloud Console: All Currently Supported
• Carbon Black Cloud Sensor: All Currently Supported
• OS: All Currently Supported

Resolution

• There are several different file flags that get processed when a new file has been detected on a system.
• If the file is new (not found in local DB) and depending on the operation being performed the "...detected during background scan" label can sometime be applied by the console.
• In most cases this will be attributed to the RepMgr64.exe process indicating the local sensor saw the file and made a reputation determination.