Carbon Black Cloud: How to Add a SHA256 Hash to Approved/Banned List

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Linux Sensor: 2.7.0.x and Higher
• Carbon Black Cloud macOS Sensor: 2.0.x.x and Higher
• Carbon Black Cloud Windows Sensor: 2.0.x.x and Higher
• Enteprise EDR Windows Sensor: 3.7.0.1253 and newer
• Linux: All Supported Versions
• macOS: All Supported Versions
• Microsoft Windows: All Supported Versions

Objective

Provide steps to add a Sha256 hash to the Company Approved List or Company Banned List

Resolution

For a single hash:

1. Log into Carbon Black Cloud Console
2. Go to Enforce > Reputation
3. Click "+Add" button
4. Select "Hash" option (default)
5. Click "Approved List" or "Banned List"
6. Paste the SHA256 value into the "SHA256 hash" field
7. Enter the application name
8. Optionally enter a comment

For multiple hashes:

1. Log into Carbon Black Cloud Console
2. Go to Enforce > Reputation
3. Click "Upload" > "File Format" to review the required format for upload
4. Click "Select" to upload a .csv when ready

Additional Notes

• Alternatively, a file's hash may be whitelisted by selecting the application name while reviewing events in the Investigate tab, provided the application is signed:
  1. Select the application name
  2. Click the "Take Action" drop-down menu
  3. Select either "Add to Allow List" or "Add to Banned List"
  4. Click the "Allow List" or "Banned List" upon the confirmation dialog box appearing
• VMware Carbon Black is working to eliminate offensive terminology
  • Approved List replaces Whitelist
  • Banned List replaces Blacklist
• There is no limit to the number of hashes that can be added to the lists.
• With Enterprise EDR only org, we do not have the functionality of adding a hash to the COMPANY APPROVED list. Adding a hash to a COMPANY BANNED list is possible with the Enterprise EDR only org.

Related Content

Cb Defense: Methods to Whitelist Applications
Cb Defense: Difference in whitelisting by hash versus Certs or IT Tools
Carbon Black Cloud: Is hash banning available in Enterprise EDR consoles?
Carbon Black Cloud: How to locate a File Hash using EEDR?