EDR: Can you search for processes using SHA256 hashes?
book
Article ID: 289187
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Can processes be searched for using SHA256 hashes instead of MD5?
Environment
EDR Server: 6.3.0 and high
EDR Sensor: 6.2.1 and Higher
Resolution
Yes. If the EDR Server is on release v6.3.0 or higher and EDR sensor is on release v6.2.1 or higher SHA256 processes can be searched for by SHA256 hash.