Carbon Black Cloud: CSV won't import IOC SHA256 hashes on Reputations Page

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Copy/Paste SHA256 hashes into .csv or create .csv file and open file using anything other than a plain text editor
• Import .csv file on the Reputations Page
• SHA256 hashes are not imported

Environment

Carbon Black Cloud Console: All Versions

• Audit and Remediation (was CB LiveOps)
• Endpoint Standard (was CB Defense)
• Enterprise EDR (was CB ThreatHunter)
• Managed Detection (was CB ThreatSight)

Cause

Embedded characters (not visible in a text editor) may be added into .csv if copying and pasting contents from another location or if the .csv file is saved after being opened in anything other than a plain text editor

Resolution

Open the .csv in a hex editor to check for and remove any hidden characters, save, and then re-import the .csv file on the Reputations Page