How to Add a Hash to the Banned List

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Add a hash to the deny or ban list 

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 3.5 and Higher

Resolution

From the Binary Details page

1. Navigate to the Investigate page
2. Click on the Processes tab and then the blue hyperlink process name or the process analysis button in the event row
3. Select the Binary Details hyperlink in the selected node side bar
4. On the Binary Details page select Add to banned list

From the Process Analysis page

1. Navigate to the Investigate page
2. Click the blue hyperlink process name or the process analysis button in the event row
3. Select the Take Action drop down menu at the top right of the Process Analysis page
4. Select Add to banned list

Additional Information

• To remove a presently blocked process from the company deny list execute the same steps above. In step 4 select Remove From Banned List
• If a hash is accidentally added to the deny list on the Binary Details page, refresh the page to display the Remove From Banned List button