Endpoint Standard: How do Reputations Interact With Policy rules?
search cancel

Endpoint Standard: How do Reputations Interact With Policy rules?

book

Article ID: 291231

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How do Reputations interact with Policy rules? 

Environment

  • Carbon Black Cloud Console: All Versions
  • Endpoint Standard Sensor: All Versions
  • Microsoft Windows: All Supported Versions
  • Apple macOS: All Supported Versions

Resolution

Policy rules and Reputations interact in different ways depending on the Policy rule type and Reputation priority.

Order of precedence:
  • Permission rules (always path-based) take precedence over all other rules and Reputations, including files that have been whitelisted or blacklisted by hash.
  • Blocking and Isolation rules configured for a specific path take precedence over all Reputation types. 
  • Reputation precedence is determined by Reputation priority​.

Additional Information

  • Reputations apply to the entire environment and are not limited to policy groups.
  • Policy rules only apply to sensors within the respective policy group.