Endpoint Standard: How do Reputations Interact With Policy rules?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How do Reputations interact with Policy rules? 

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

Policy rules and Reputations interact in different ways depending on the Policy rule type and Reputation priority.

Order of precedence:

• Permission rules (always path-based) take precedence over all other rules and Reputations, including files that have been whitelisted or blacklisted by hash.
• Blocking and Isolation rules configured for a specific path take precedence over all Reputation types. 
• Reputation precedence is determined by Reputation priority​.

Additional Information

• Reputations apply to the entire environment and are not limited to policy groups.
• Policy rules only apply to sensors within the respective policy group.