Endpoint Standard: How to Automatically Ban a Hash

[#1]

Environment

• Carbon Black Cloud Console: All Versions

Objective

WARNING: By configuring Auto ban, critical applications could be impacted based on Policy Rules. 
For example, if Notepad.exe was a participant in an attack that reached the threat level set in auto black list, it could be disabled company wide based on Policy settings.

Provide information on how to automatically ban a hash.

Resolution

1. Go to Enforce - Reputation 
2. Click on Auto Ban 
3. Set the threshold for threat level. Anything equal or greater than the defined threat level will be added to the ban list
4. Click Save

Related Content

Cb Defense: Methods to Whitelist Applications
Endpoint Standard: How to add a SHA256 hash to Approved/Banned List