The Carbon Black Cloud sensor assigns reputations to network files when these files are either in a No Execute state or Pre-Execute state.

  • Unknown (RESOLVING) reputation indicates that the sensor has not reached the Carbon Black Cloud backend.
  • Definite reputation refers to any Carbon Black Cloud reputation except the NOT_LISTED and RESOLVING reputations.
  • Local Scanner is not supported on macOS devices.
Reputation assignment for network files diagram

Assign Reputations for Network Files in No Execute State

The Carbon Black Cloud sensor assigns reputations to network files when these files are in No Execute state and the Scan files on network drives option is enabled.

  • The Carbon Black Cloud sensor scans files residing on network drive and on file READ sends a reputation request (every sixty seconds).

    If another file attempts to access the file, the sensor does not generate another reputation request.

  • The sensor applies the Unknown reputation until it receives a reputation from the Carbon Black Cloud.
  • If the Scan files on network drives option is disabled, the sensor does not assign a reputation until the network file attempts to EXECUTE.

Reputation Assignment for Network Files in Pre-Execute State

The Carbon Black Cloud sensor assigns reputations to all files on a network drive when these files are in Pre-Execute state and the Scan execute on network drives option is disabled.

  • The Carbon Black Cloud sensor calculates the SHA256 hash for all files on EXECUTE so that each file is tracked and recorded, and sends a reputation request to Carbon Black Cloud (every sixty seconds).

    If another file attempts to access the file, the sensor does not generate another reputation request.

  • The sensor applies the Unknown reputation until it receives a reputation from the Carbon Black Cloud. After Carbon Black Cloud returns the requested reputation from the sensor, policy rules can apply to the network file.
  • If the Scan execute on network drives option is enabled, the reputation assignment process is the same as for a new file attempting to execute for the first time (pre-execute). For more details, see Reputation Assignment when Delay Execute for Cloud Scan and On-Access File Scan Mode are Enabled.