CB LiveOps: Files Accessed With "Get" Command are Renamed as Extensionless Files After Download
search cancel

CB LiveOps: Files Accessed With "Get" Command are Renamed as Extensionless Files After Download

book

Article ID: 288887

calendar_today

Updated On:

Products

Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

  • The "Get" command is used to obtain a file from a client machine during a LiveOps session
  • The LiveOps session report "File ready for downalod"
  • The Save file option is selected from a web browser prompt
  • When viewed in File Explorer, the file has been renamed with an alphanumeric string and no extension
  • Double-clicking the file will open a Windows prompt to select an application¬†to open

Environment

  • CB LiveOps PSC Sensor: All versions
  • CB LiveOps PSC Console: All versions

Cause

This is expected behavior in regards to LiveOps file handling

Resolution

To access a single file:
  1. Right-click the file and chose the "Open with" option
  2. Choose  the appropriate program (such as Notepad for .txt files)
  3. The file will open as expected
To access a compressed file:
  1. Use a decompression utility to unpack the file
  2. Access contents through File Explorer

Additional Information

The transferred files can also be renamed with the apporpriate extension to facilitate opening and identification