Can a Customizable Pop-up Message Be Displayed When Putting an Endpoint Into Quarantine?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Is it possible to show an end-user a customizable message, pop-up, warning, or alert when their device is placed in Quarantine?

Environment

• Carbon Black Cloud: All Supported Versions
• Carbon Black Cloud Sensor: All Supported Versions
• Carbon Black Cloud APIs: All Supported Versions

Resolution

• It is not currently possible to customize this from the Console.
• The Policy Service API could be leveraged to configure a custom QUARANTINE_DEVICE_MESSAGE.

Additional Information

• It may be possible to use a message feature built in to the OS, similar to the Windows msg command:

  exec msg * /time:3600 <YourMessageHere>

• A generic "Device has been quarantined by your computer administrator" message is displayed in local sensor UI when device is quarantined.
• To see this added to the Console in a future release, please submit this as a new feature idea.