Environment
- Carbon Black Cloud Sensor: All Versions
Question
Why does CBC Sensor not automatically update a hash's value?
Answer
The CBC Sensor does indeed automatically update the hash values but it can take time.
Additional Notes
The Sensor has a Database to cache the values and speed up performance. As hashes with a reputation are seen a Time to Live "TTL" is associated with the hash and the source. These values can be ignored by placing a hash in the Console for a
Reputation Bypass. If you only have a system or two with the cached value and the reputation has been resolved and flushed at the Org level then you can
flush it locally on the system.
Related Content
