- No. CVEs report known vulnerabilities of commonly used software, not a list of malware hashes.
- CVEs rarely contain hashes, instead they include software versions affected by the vulnerability.
- A watchlist containing hashes for commonly used software would create alert fatigue.
- If a CVE did include a hash (unlikely), the Investigate search page could be used to find the hash in the environment.
- If the hash is found, it may be advisable to create a custom watchlist to monitor its use until the patch is available.
- Carbon Black creating custom watchlists for commonly used software hashes for all customers is not maintainable.
Example: If the CVE reports Firefox versions < 82.0.3 (CVE-2020-26950) are vulnerable, then alerts should not occur for each use of Firefox. Instead, the vulnerability requires a certain configuration be met (an environmental setting) before or after Firefox starts; The CBC administrator would determine if the certain configuration is needed in their environment.