Endpoint Standard: USB Mass Storage Device Not Present in the Inventory in Device Control

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

A USB mass storage device is not present in the inventory.

Environment

•    Endpoint Standard Web Console: November '20 Release (0.60) and Higher
•    Carbon Black Cloud Windows Sensor: 3.6.0.1897 and Higher
 

Cause

This can happen when a device is unexpectedly classified as something other than a USB mass storage device by the Operating System. 

Resolution

• Please follow the steps outlined in this article to confirm whether or not the device is being classified properly
  • https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-to-Identify-a-Supported-Device-for-Device/ta-p/97500
• If the OS did correctly identify all three identifiers Product ID, Vendor ID, and Serial Number please open a case with VMware Carbon Black support.

Additional Information

To provide visibility to the end user and security administrator, if blocking is enabled and this external device is being blocked, an Alert in the Carbon Black Cloud console will be created and the end user will be notified by a sensor UI pop up and log entry.