CB Defense: False positive ransomware alerts for applications accessing disk space
book
Article ID: 290448
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Alert reason says 'The application attempted to access the raw disk on the device. This is potentially due to Ransomware'
Environment
CB Defense Sensor: 3.1.0 and above
Cause
This is a known issue tracked with the ID, DSEN-1987
Resolution
If the alert is a known false positive, the alert can be dismissed for that and all future devices by selecting the check box next to "If this alert occurs in the future, automatically dismiss it from all devices"