EDR: How To Export Banned Hashes

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Export a list of hashes banned in an environment.

Environment

EDR: All supported versions

Resolution

Exporting a list of banned hashes from an EDR server is not a visible feature or button found in the EDR console at this time.

To access a list of banned hashes, log in to the console and replace the URL with: https://<server>/api/v1/banning/blacklist

The list of banned hashes can also be accessed via the API, more information is located on the Developer Relations website, links found under 'Additional notes'

Additional Information

For Versions 7.5+: https://developer.carbonblack.com/reference/enterprise-response/latest/rest-api/#banning
For Versions 6.3-7.4: https://developer.carbonblack.com/reference/enterprise-response/6.3/rest-api/
For Versions 6.0-6.2: https://developer.carbonblack.com/reference/enterprise-response/6.1/rest-api/#banning