Creating Process Hash Bans

You can ban a process MD5 hash from several locations in the Carbon Black EDR console.

• The Binary Details page has a Ban this hash button if the binary is an EXE.

• The Process Analysis page has a Ban this hash command on the Actions menu.

• The Manage Banned Hashes page includes the Ban More Hashes button. You can click this button to specify one or more MD5 hashes to be banned. The Manage Banned Hashes page also has checkboxes that allow previously configured bans to be disabled and re-enabled.

• Note:

  Banning a process hash without knowing the purpose of the process can have serious consequences. While Carbon Black EDR sensors prevent you from banning most critical processes, a user can ban a process that is required for proper operation of your computers or your business applications. Make sure that all Carbon Black EDR console users understand this before they use the banning feature.