EDR: Banned Hashes Page Only Shows 500 Hashes

[#1]

Environment

• EDR Server: All versions
• RHEL: All supported versions
• CentOS: All supported versions

Symptoms

• Banned hash count of 500 or more
• Banned Hashes page displays only 500 for the count

Cause

• The web UI only displays 500 hashes and is not paginated.

Resolution

There are two workarounds to retrieve a full list of current actively banned hashes

1. Perform the following SQL query via SSH:

psql cb -p 5002 -c "SELECT * from banning_blacklist"

2. Leverage the Cb Response API:

https://<Servername>/api/v1/banning/blacklist?count=10000"

 

Additional Notes

• A product enhancement to improve the Banned Hashes page functionality is being tracked internally via CB-10084
• The API can support up to 10,000 banned hashes
• Hashes that are no longer enabled can be removed via the "cbbanning purge-inactive" command. CB Response: To mark and purge disabled or inactive banned hashes from the Managed Banned Hashes pag...

Related Content

• REST API Reference CB R 6.0-6.2x - Carbon Black Developer Network
• Re: OSX Sensor Install and Rule Creation
• https://community.carbonblack.com/ideas/2988
• CB Response: To mark and purge disabled or inactive banned hashes from the Managed Banned Hashes pag...