CB Defense: Child Process Hashes Are Not Passed to Splunk Feed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Upon review, only parent processes appear to be included in the Splunk feed

Environment

• CB Defense Add-On for Splunk

Cause

• Known limitation

Resolution

Please feel free to vote for the idea https://community.carbonblack.com/t5/Idea-Central/Splunk-Feed-Include-both-parent-and-child-SHA256-hashes/idi-p/70553 to have both parent and child SHA256 hashes included in the Splunk feed