Does the Carbon Black Cloud Sensor Have Quarantine Exclusion Capabilities?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Can exclusions be added to the sensor so it can communicate to specific locations during quarantine?

Environment

• Carbon Black Cloud Sensor: All Supported Versions

Resolution

• At this time there are no quarantine exclusions for the Carbon Black Cloud sensor but this is being looked into
• As a workaround a "quarantine" policy can be setup with a blocking rule like ** | communicates over the network | deny
• These blocking rules do get superseded by permission rules which can be setup to allow communication with specific application while blocking network communication of all other applications

Additional Information

If needed reach out and submit as a feature request