Carbon Black Cloud: What is the Difference Between Groups and Policy?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What is the difference between a group and a policy in the Carbon Black Cloud Console?

Environment

• Carbon Black Cloud Console: All Versions

Resolution

• In the console, groups are found in the left hand banner on the endpoints page, and are designed to provide an automated way to both organize sensors and assign them a policy. 
• A group will always have a policy assigned to it, but a single policy may be assigned to multiple groups.   
• Policies are specific sets of rules and permissions that govern whether sensors will either allow or deny a specific operation on an endpoint.

Additional Information

• If a sensor is manually assigned to a policy, it cannot be assigned to a group.
• When automatic assignment is enabled, sensors are assigned to the first group with matching criteria. 
• Clicking the "Reorder Groups" button on the endpoints page allows the order of the groups to be changed to ensure sensors are being assigned correctly.