Carbon Black Cloud: CSV won't import IOC SHA256 hashes on Reputations Page
book
Article ID: 290263
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Copy/Paste SHA256 hashes into .csv or create .csv file and open file using anything other than a plain text editor
Import .csv file on the Reputations Page
SHA256 hashes are not imported
Environment
Carbon Black Cloud Console: All Versions
Audit and Remediation (was CB LiveOps)
Endpoint Standard (was CB Defense)
Enterprise EDR (was CB ThreatHunter)
Managed Detection (was CB ThreatSight)
Cause
Embedded characters (not visible in a text editor) may be added into .csv if copying and pasting contents from another location or if the .csv file is saved after being opened in anything other than a plain text editor
Resolution
Open the .csv in a hex editor to check for and remove any hidden characters, save, and then re-import the .csv file on the Reputations Page