Enterprise EDR: Sensor Does Not Honor Bypass Exclusions

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard (formerly CB Defense)
  • Enterprise EDR (formerly CB ThreatHunter) 
• PSC Sensor: 3.3.x.x and Higher
• Microsoft Windows: All Supported Versions
• Apple macOS:: All Supported Versions

Symptoms

Within ThreatHunter orgs that have Endpoint Standard Rules enabled or have both Endpoint Standard and Enterprise EDR, bypass rules do not appear to be honored as the console still shows Enterprise EDR data.

Cause

Bypass rules created under the standard Policy pages do not apply to the Enterprise EDR portion of the sensor. This means that the sensor will still record events locally and upload these to the console despite a bypass rule in place.

Resolution

Event Reporting and Sensor Operation Exclusions Announcement

Additional Notes

To validate the bypass rules are working on the EndPoint Standard side please review the following KB:
CB ThreatHunter: How to determine if an Event is from CB Defense data
Procmon captures should not show ctiuser.dll injections for bypassed processes as Enterpise EDR doesn't require injection but EndPoint Standard does

Related Content

CBC: Where is the documentation on when to use Policy permissions vs Core Preventions vs the new Eve...
Enterprise EDR Getting Started Guide
Cb ThreatHunter: How to search for processes with name changes
CB ThreatHunter: How to search based on Reputation