Carbon Black Cloud: Do TAU-TIN Hashes Need to be Manually Banned?
book
Article ID: 289367
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Do Known_Malware hash IOC's from TAU-TIN reports need to be banned or should the CDC reputation be known_malware already?
Environment
- Carbon Black Cloud: All Supported Versions
Resolution
- IOC's within TAU-TIN reports should already have had the online reputation be updated to known_malware (if that is what the IOC was listed as)
- It may not be necessary to have to manually ban the IOC's to prevent them from running depending on the policy settings
Additional Information
- Company_banned reputation has a higher priority then known_malware and has a different policy setting
- If a TAU-TIN IOC is listed but the backend reputation doesn't appear to match please reach out as this may be in error
Feedback
thumb_up
Yes
thumb_down
No