Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Endpoint Standard: Why does CBC Sensor not automatically update a hash's value?

Endpoint Standard: Why does CBC Sensor not automatically update a hash's value?

Environment

  • Carbon Black Cloud Sensor: All Versions

Question

Why does CBC Sensor not automatically update a hash's value?

Answer

The CBC Sensor does indeed automatically update the hash values but it can take time. 

Additional Notes

The Sensor has a Database to cache the values and speed up performance. As hashes with a reputation are seen a Time to Live "TTL" is associated with the hash and the source. These values can be ignored by placing a hash in the Console for a Reputation Bypass. If you only have a system or two with the cached value and the reputation has been resolved and flushed at the Org level then you can flush it locally on the system

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-22-2022
Views:
333
Contributors