Endpoint Standard: More than 1 Alert generated from 1 Event

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• 2 Alerts are generated for the same Event ID

Environment

• Carbon Black Cloud Console

Cause

• This is expected behavior and working as designed

Resolution

• This is expected behavior and working as designed

Additional Information

• This generation of 2 Alerts from the same Even ID is from different detection techniques
• One Alert is generated for Hash detection, such as when a Hash with Known Malware Reputation is detected by the Sensor
• One Alert is generated from Behavior detection, when the actions involved with the Hash is detected by the Sensor.