Endpoint Standard: Duplicate Device Control Alerts

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Multiple alerts are seen for the same device.

Environment

•    Endpoint Standard Web Console: November '20 Release (0.60) and Higher
•    Carbon Black Cloud Windows Sensor: 3.6.0.1897 and Higher
 

Cause

The “dismiss on future” feature wasn’t used on the alert.

Resolution

When receiving an alert notification for a specific device use “dismiss for future” to suppress additional duplicate alerts. “Dismiss for future” is based on unique VID, PID, and Serial combinations.