Endpoint Standard: What Do The Reputation Values Mean For Different Sections Of Investigate Page?
book
Article ID: 288685
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
What do the Reputation values mean for different locations on the Investigate Page?
Environment
Carbon Black Console: All Versions
Endpoint Standard
Investigate Page
Resolution
There are three different reputations which can be seen for all applications tied to an Event. The table below provides more detail
Reputation types
Name
Investigate page Location
Description
Reputation
Selected/Target/Parent App tabs, above Event list
Current reputation in the Carbon Black Cloud (Formerly Predictive Security Cloud - PSC)
App/Parent/Target Reputation
Expanded Event details
Carbon Black Cloud reputation for hash, matched to the time of the Event after uploading to the Carbon Black Cloud for analysis
App/Parent/Target Reputation (applied, {source})
Expanded Event details
Highest priority reputation (from all sources) the Sensor had at the time of the Event; used to determine whether to take action based on Policy Rules. Sent up to the Carbon Black Cloud from the Sensor
Reputation sources
Source
Description
cloud
Sensor applied the hash reputation from Carbon Black Cloud
AV scan
Sensor applied the hash reputation from local AV scanner
pre-existing
Sensor treated the hash as "Pre-existing" file, and gave it a "Local_white" reputation
cert whitelisting
Sensor applied the Cert Approved list to give this hash a "Local_white" reputation
IT tools
Sensor applied the IT Tools Approved list to give this hash a "Local_white" reputation
hash reputation list
Sensor applied the Company Approved list/Banned list database reputation
white database
Sensor applied the Carbon Black Cloud Approved list Database
Additional Information
The Reputation in the Tabs for Selected, Parent and Target Apps is the current Carbon Black Cloud Reputation for the Hash
While the Event Details will show the the data at time of execution, these Tabs are the current values for comparison and to show updates