CB Defense: File Signature Information Not Displayed In Console
book
Article ID: 289617
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
- Alert Triage Page Displays No Signature Information
- Investigate Page Event Details Displays No Signature Information
- File Properties Show the File is Signed
- Sites Like VirusTotal Show File Signature Information
Environment
- CB Defense Sensor: 3.4.0.1097 and Lower
- Microsoft Windows: All Supported Versions
Cause
The sensor is failing to open the file, because the process that created the file, still has it locked, preventing us from retrieving the information
Resolution
Upgrade Sensor Version to at least 3.5.0.1523
Additional Information
DSER-6534 Tracked the issue and fix, which was addressed in the 3.5.0.1523 Sensor (this was not documented in the Release Notes)
Feedback
thumb_up
Yes
thumb_down
No