Cb Response: Ingress Filters Not Working

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Ingress Filter(s) based on path_filters
• Ingress Filter(s) based on md5_filters
• Ingress Filter(s) based on command line
• Ingress Filter(s) implemented with no error output
• Ingress Filter(s) hit_rate is 0.0
• Ingress Filter(s) have uppercase characters

Environment

• Cb Response Server: 6.x.x and higher
• Cb Response Sensor: 6.x.x and higher

Cause

The path_filters, md5_filters, and command line filter types are case sensitive.

Resolution

All variables configured within the path_filters and md5_filters filter types must be in all lowercase. Command line parameters can sometimes be entered in either lowercase or uppercase, so it might be necessary to create two separate filters, one with the uppercase and one with lowercase to match all the variations. Alternatively, a case insensitive regular expression (rxi) could be used to create a single filter to match both.