CB Defense: Why Is The Inbox Filled With Delete Hash Events?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why is the CB Defense Inbox getting a lot of Delete Hash Events, days after a "Permanently delete the application from all devices across your organization" was done

Environment

• CB Defense PSC Console: All Versions
• CB Defense PSC Sensor: 3.2.x and Higher
• Microsoft Windows: All Supported Versions

Resolution

• This happens because an event is created for each device in the org sending this request to all the devices in the org
• Another event will happen for each device once it has checked in and this request has been processed