Quarantined devices cannot reach back-end and never come out of quarantine

Products

• Carbon Black Cloud Workload
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Sensors placed in quarantine cannot communicate with backend to receive unquarantined notification

Environment

• Carbon Black Cloud Sensor: 3.7.x
  • Endpoint Standard
  • Workloads
• Microsoft Windows: All Supported Versions

Cause

This is identified as an issue DNS and DHCP - DSEN-16642

Resolution

• The issue was fixed in a 3.8 sensor release
• For workarounds, contact Carbon Black Support

Additional Information

Similar behavior can happen if other security software is installed which verifies if the endpoint is allowed to connect to the network/internet and is conflicting with the CBC Quarantine mode, in that case quarantine exclusions may be needed