Cb Response: Are disabled hashes from the Banned Hashes list still stored on endpoints?
search cancel

Cb Response: Are disabled hashes from the Banned Hashes list still stored on endpoints?

book

Article ID: 290621

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Do endpoints retain records of previously banned hashes or only the currently banned hashes?

Environment

  • Cb Response Server: All Versions
  • Cb Response Sensor: All Versions

Resolution

  • Only actively banned hashes will be stored on an endpoint. 
  • If a hash is removed from the banned list, the endpoint will remove that hash from its database during the next sync