Cb Response: Are disabled hashes from the Banned Hashes list still stored on endpoints?
book
Article ID: 290621
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Do endpoints retain records of previously banned hashes or only the currently banned hashes?
Environment
- Cb Response Server: All Versions
- Cb Response Sensor: All Versions
Resolution
- Only actively banned hashes will be stored on an endpoint.
- If a hash is removed from the banned list, the endpoint will remove that hash from its database during the next sync
Feedback
thumb_up
Yes
thumb_down
No