CB Protection: "Normalized" MSI or MSP hash changes after upgrade of agent version

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Hash is different between 8.1.0 and 8.1.4+ agents
• MSP files show different hash on some, but not all agents
• Hash is different than Powershell hashing returns

Environment

• CB Protection Agent: 8.1.4 and Higher

Cause

This is caused by the agent Normalizing the hash data. It removes things that are time or device specific, and provides the hash that's normalized for all agents. 

Resolution

1. Upgrade all devices to at least 8.1.4 to verify all return the same hash
2. To re-scan MSP files, push a Cache Check to all devices https://community.carbonblack.com/t5/Knowledge-Base/CB-Protection-How-To-Perform-A-Cache-Consistency-Check/ta-p/77098

Additional Information

The automatic re-scan of MSP files is tracked as EP-9786 and will be introduced in a future release