Cb Defense: Unable To Automatically Dismiss Alerts From All Devices

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to implement a workaround for dismissing grouped Alerts to bulk-dismiss similar alerts but not dismiss them for future / with persistence.

Environment

• Cb Defense Web Console: All Versions
• Cb Defense Sensor: 2.0.2.x+ (Windows)
• Cb Defense Sensor: 1.2.3.x+ (Mac)
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Resolution

1. Go to the Alerts page
2. Turn Group Alerts on
3. Select the desired Alert(s)
4. Select Dismiss or Dismiss on all devices from the drop-down on the far-right
5. Leave If this alert occurs in the future, automatically dismiss it from all devices unchecked
6. Enter a Comment as desired in the (Optional) for audit log field
7. Click Dismiss

Additional Information

If you are facing this same issue you do not need to submit a case at this time, as all cases to this point have shown the same behavior.

Follow the steps below to confirm you are facing the same issue.

1. Go to the Alerts page
2. Open Developer Tools (F12 in chrome and firefox)
3. Select an Alert which you have previously been unable to dismiss with persistence or for the future
4. From the drop-down on the far-right select Dismiss or Dismiss on all devices
5. Check If this alert occurs in the future, automatically dismiss it from all devices
6. Click Dismiss
7. Check the Network tab in Developer Tools for the dismiss item
8. Review the Response and you will see an error like the following

   {"success":false,"message":"Threat <32digitThreatID> is already DISMISSED"}

9. Copy the ThreatID
10. Go to the Audit Log and search for that ThreatID with the time set to All Time to see the original dismissal