Host-Based Firewall rule events show wrong directionality of netconn traffic

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Host-Based firewall rule events in the CB Cloud Console show netconn traffic incoming/outgoing the wrong direction compared to the raw netconn traffic details.

Environment

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Windows OS Sensor: 4.0.0 and Lower
• Windows OS: All Supported Versions

Cause

Sensor defect caused a misrepresentation of the directionality of the raw netconn event data in Host-Based Firewall rule events.

Resolution

DSEN-27946 fixed the directionality issue and was released in the 4.0.1 (4.0 MR1) sensor release.