Endpoint Standard: How to Verify a Decoy/Canary File is involved in an Alert
book
Article ID: 290539
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Provide guidance on identifying Alerts linked to a decoy or canary file
Environment
Carbon Black Cloud Console: All Versions
Endpoint Standard (was CB Defense)
Carbon Black Cloud Sensor: 3.0.x.x and Higher
Microsoft Windows: All Supported Versions
Apple macOS: All Supported Versions
Resolution
Go to the Alerts page
Search for alerts where the reason code is T_CANARY
reason_code:T_CANARY
Resulting list is Alerts linked to canary files
Additional Information
If 'T_CANARY' is listed as the reason for the Alert the file is a canary or decoy file; if not, investigate the Alert further
Canary or decoy files were introduced with the 3.0.x.x Sensor for Endpoint Standard (was CB Defense) and are included in the Carbon Black Cloud Sensors of higher versions