Carbon Black Cloud: Does The Sensor Support App Volumes?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does the Carbon Black Cloud Sensor support App Volumes?

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• VMware App Volumes

Resolution

Currently App Volumes is not officially supported by the Cloud Sensor.

Additional Information

• The Sensor will not have visibility into items deployed via App Volumes as those get added when the endpoint would not be running. This will cause interoperability issues with the Sensor for both non-functionality performance, as well as functional correctness issues.
• Large changes to the Base Image typically would require an uninstall/reinstall of the Sensor after all App Volume related changes, then redeploying after the Background Scan has fully completed to avoid Cloud Reputation Lookups on the App Volume files for each Clone.
• No testing for interoperability between the Sensor or App Volumes is conducted in-house due to the current unsupported nature of App Volumes.