CB Defense: Sensor fails to parse path-based rules that start with a single blackslash (\)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Permission rules that start with a single blackslash will not take effect e.g. \path\**
• Observe interop issues with apps such as Box and Google FileStream cloud file sharing apps

Environment

• CB Defense PCS Console: All Versions
• CB Defense PSC Sensor: 3.5 and below
• Microsoft Windows: All Supported Versions

Cause

This happens due to a bug which prevents the sensor from parsing this path

Resolution

• Workaround: Add wildcards before the backslash. e.g. *\path\
• Fix: This has been resolved in Sensor version 3.5.0.1590