All Products: How to report Malware False Positives to VMware Carbon Black?

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• App Control: All Versions

Question

If hash is classified as malware, but it should be trusted approved, how should this be reported to VMware Carbon Black?

Answer

Please Open a Support case with the following information:

1. The affected hash(es)
2. Current Reputation
3. Expected Reputation
4. Associated Events
5. Alert ID (if available)
6. Reason(s) why the hash is believed to be legitimate

Related Content

Endpoint Standard: How to add a SHA256 hash to Approved/Banned List
CB Defense: Deny/Terminate action taken on Whitelist Application
Endpoint Standard: Reputation Priority