Carbon Black Cloud: How to find devices impacted by ManifestDownloadFailure or ContentDownloadFailure

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Explain process for obtaining a full list of devices sending ManifestDownloadFailure (macOS, Windows) or ContentDownloadFailure (Linux) alarms

Environment

• Carbon Black Cloud: 02-Mar-2023 and later
• Carbon Black Cloud Sensor (Linux): v2.12.x.x and Higher
• Carbon Black Cloud Sensor (macOS): v3.5.3.x and Higher
• Carbon Black Cloud Sensor (Windows): v3.6.0.x and Higher

Resolution

Via Support Case

• This option works for all applicable Sensor versions and OSes
• Open a case with VMware Carbon Black Technical Support and provide

  Org Key: 
  Example Alert: alert_id

 

Via Audit & Remediation

• This option only works for Windows Sensors on v3.8.x.x and higher
• Use the Sensor Manifest Download Errors query in the IT Hygiene category