CB Response: Threat Report sha256 IOC is unavailable on process analysis page

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When viewing the process analysis page of a process tagged with a threat report, the following message is presented under the Alliance Feeds section:

The process has been tagged with the following reports: Report "$report_name_here" from feed $feed_name_here.

If not on the current page, the report(s) are either unavailable, or the tagged events are on another page.

Environment

• CB Response Server: 6.3 and Higher

Cause

If the IOC is a sha256 IOC type, this is related to an issue in the product.

Resolution

An internal engineering ticket (CB-31341) has been created to resolve this issue in a future release of the product. This article will be updated once a target release date has been made available.