Carbon Black Cloud: CSV won't import IOC SHA256 hashes on Reputations Page

[#1]

Environment

Carbon Black Cloud Console: All Versions

• Audit and Remediation (was CB LiveOps)
• Endpoint Standard (was CB Defense)
• Enterprise EDR (was CB ThreatHunter)
• Managed Detection (was CB ThreatSight)

Symptoms

• Copy/Paste SHA256 hashes into .csv or create .csv file and open file using anything other than a plain text editor
• Import .csv file on the Reputations Page
• SHA256 hashes are not imported

Cause

Embedded characters (not visible in a text editor) may be added into .csv if copying and pasting contents from another location or if the .csv file is saved after being opened in anything other than a plain text editor

Resolution

Open the .csv in a hex editor to check for and remove any hidden characters, save, and then re-import the .csv file on the Reputations Page

Related Content

CB Defense: Error Uploading CSV File To Blacklist or Whitelist
Cb Defense: Methods to Whitelist Applications
Cb Defense: How to whitelist or blacklist a hash
Cb Defense: Difference in whitelisting by hash versus Certs or IT Tools