Managed Detection: How to Remove Repeat Results From Trusted Processes/Files

Products

• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)

Issue/Introduction

How do I remove repeated results in ThreatSight Reports for trusted processes? 

Environment

• Carbon Black Cloud Console: All versions
• Managed Detection Reports

Resolution

The values in the ThreatSight Reports are based on the Alerts ThreatSight uses for the data. By setting dismissals for Grouped Alerts in the future and possible Policy Permissions to filter out these Alerts they will not show in the ThreatSight Reports. 

Additional Information

Using Grouped Alerts for future dismissal is the best way to filter out the trusted applications not being Terminated by the Policy Rules. This still logs all the information but helps seeing the significant Events / Processes easier for review.