Endpoint Standard: Alert Only Shows the Hash of a Child Process

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Observation for a childproc event assigned to an Alert ID does not contain a filename, command line, or PID, and instead only displays the SHA256 hash, process username, and file reputation.

Environment

• Carbon Black Cloud Console: All Versions

Cause

This issue is currently under investigation by Carbon Black engineers and understood to be a discrepancy in how the data is populated from the API.

Resolution

No workaround is available at this time.

Additional Information

If the unknown hash's process name is not found elsewhere in the Console by searching the hash on the Investigate page, it can also be searched in VirusTotal, or other search engine, for identification.