EDR: Is there a maximum binary download size?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is there a maximum binary download size in CB Response?

Environment

• EDR Server: All Supported Versions

Resolution

Yes, the maximum size is 25MB.

Additional Information

Since most malicious files on average are less than 25MB, that is the maximum size of the binary files that the Carbon Black Collective Defense Cloud backend will store. This prevents storage issues on the backend, but will prevent users from pulling copies of very large files via the EDR console. Files larger than 25mb will need to be pulled from the endpoint on which they are found for comparison.