Carbon Black EDR: Hash for PKZIP and PE files for the filemods are visible in the EDR console but it does not show the hash value for other files.
search cancel

Carbon Black EDR: Hash for PKZIP and PE files for the filemods are visible in the EDR console but it does not show the hash value for other files.

book

Article ID: 391987

calendar_today

Updated On:

Products

Carbon Black EDR Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Hash for PKZIP and PE files for the filemods are visible in the EDR console but it does not show the hash value for other files.

Environment

Carbon Black EDR: All versions.

Cause

CB detects file types solely by the file headers

Resolution

We collect information on specific non-binary types based on the headers and not using the extensions.

More information: https://techdocs.broadcom.com/us/en/carbon-black/edr/carbon-black-edr/7-8-1/edr-ug/GUID-4B057A77-972B-4298-A5A0-1E37AF91F13D-en/GUID-B9C6CAA0-6D62-43BD-8902-1B8591A87E34-en/GUID-9CF0F950-E9B8-45C7-9FD5-887866657AAF-en/GUID-22E6D293-84BF-49F0-823C-084FAE4C6945-en.html

Powered by Wolken Software