Endpoint Standard: Wrong sensor group detected if AD Criteria has FQDN

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Sensor is set to be automatically assigned to a sensor group and the associated policy
• AD criteria includes FQDN including terms like ".com or .in or .local" or any similar extension
• Irrespective of the remaining criteria, the search matches the extension and assigns the sensor to the first sensor group available

Environment

• Carbon Black Cloud (Formerly PSC) Console: All Versions
• Endpoint Standard (Formerly CB Defense) Sensor: All Versions
• Microsoft Windows: All Supported Versions

Cause

When matching sensor groups by AD Domain that contains ".com or .in or .local" or any similar extension, it treats each term of the name as a separate matching test

Resolution

• Ensure that the AD Criteria does not include terms like ".com or .in or .local" or any similar extension that may be common between multiple Sensor group Criteria
• Example: Change AD criteria from Contains "abc.com" to Contains "abc"