Carbon Black Cloud: How to filter alerts involving USB or any other removable media as threat vector

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to filter alerts based on the threat vector being a removable media

Environment

• Carbon Black Cloud (formerly PSC) Sensor: All Versions
  • Audit & Remediation (was CB LiveOps)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
  • Managed Detection (was CB ThreatSight)

Resolution

This can be found in one of the following two ways:

• Run below search query on the Alerts page: 

  threat_vector: REMOVABLE_MEDIA

• Navigate to Dashboard > "Attacks By Vector" > Click on Removable Media 

Additional Information

Vector: REMOVABLE_MEDIA is mentioned as Alert Origin under "Alert Origin, Behavior, Notes and Tags" on the Alerts Triage page for USB or other removable media related alerts