Cb Response: Are disabled hashes from the Banned Hashes list still stored on endpoints?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Do endpoints retain records of previously banned hashes or only the currently banned hashes?

Environment

• Cb Response Server: All Versions
• Cb Response Sensor: All Versions

Resolution

• Only actively banned hashes will be stored on an endpoint. 
• If a hash is removed from the banned list, the endpoint will remove that hash from its database during the next sync