Carbon Black Cloud: Can Policy Rules Be Created To Block Network Activity?

[#1]

Environment

• Carbon Black Cloud Console: All Versions

Question

Can an administator utilize policy rules to block network based activity?

Answer

Yes, you can create a policy rule with the "Communicates over the network" Operation Attempt, using either "Deny operation" or "Terminate process" to block the behavior for specific applications, filenames or paths.

Additional Notes

• Network rules cannot be made more granular, meaning that specific IP ranges, URLS, etc. cannot be leveraged in policy rules.
• The "Communicates over the network" Operation Attempt involves any attempted network access, so applications that have been blocked via policy rules will not be able to connect at all.

Related Content

CB Defense: Do “Blocking and Isolation – Communicates Over the Network” Rules Work for File Shares?
CB Defense: How to Block Applications From Communicating Over the Internet