Sagan low stable other

Carbon Black Endpoint Server detected

Carbon Black Endpoint Server detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"Carbon Black Endpoint Server detected"; program:cb_usb_approval_data; metadata: fingerprint_source logs, fingerprint_os carbonblack, fingerprint_expire 86400; threshold: type suppress, track by_src, seconds 43200, count 1; classtype:fingerprint; sid:5100167; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...