Getting Help
Red Canary
- Changing Hostname in Red Canary
- Red Canary Login Session Timeout Settings
- Red Canary Filtering for endpoints - multiple filters
- What is Red Canary's Data Retention Policy?
- Gaps in alert or detection ID sequence numbers
- No variation in How do we compare to other organizations? report
Canary Exporter
Reporting
Alerts
- How to Setup Okta Workforce Identity Alerts in Red Canary
- Can You Whitelist an Application in Red Canary and then Only Receive Email Alerts When That Application is Used?
- How to suppress an external alert from triggering a detection ?
- How Are Risk Scores Determined In Red Canary External Alerts
- How to Generate a Custom TLS Certificate For Your Alert Source Configuration
API
- API query time-outs
- How to Utilize the Red Canary API to Query for Endpoints that are Not Sending Telemetry
- Where to find detection API schemas
- Red Canary API Specification File
- Bulk Reinstatement of Decommissioned Endpoints via API
Automate
- SMS not sending to India
- Automate Playbook Will Fail If The Trigger Is Set For External Alert Data, But the Playbook Is Configured For Detection Data.
- Can We Use Filter Operations On Our Playbook Payload Variables?
- Multiple Action Approval Request over Slack
- Can Automation integrate with JAMF to isolate/lockdown an Endpoint?
Integrations
VMware Carbon Black
- "Long Term Support" for VMware Carbon Black EDR sensors
- How to Collect a HAR File Using Chrome
- ARM Architecture Support for VMware Carbon Black Products
- Does VMware Carbon Black Support Endpoints Running the Unbreakable Enterprise Kernel (UEK)?
- Full Disk Access In macOS Security & Privacy Settings Is Not Showing As Enabled After Deploying Policies With Jamf
- VMware Carbon Black sensor install request pending
Carbon Black Cloud (ThreatHunter/Defense)
- How to enable/disable sensor bypass via command line
- Not Seeing Telemetry When Using VMware Carbon Black Cloud Endpoint Standard
- How Long Does It Take for a Sensor to Upgrade After It’s Requested?
- Define On-premises Devices
- No Alerts for POLICY_DENY Events for KNOWN_MALWARE Reputations in Endpoint Standard
Carbon Black EDR (Response)
- How to enable the CB Yara Manager
- What kinds of files does the VMware CB EDR sensor collect?
- Tamper Protection is enabled on the sensor group, but endpoints are reporting Detect as the current status
- Can you export data from Carbon Black EDR to Arctic Wolf?
- How to disable Carbon Black EDR tamper protection on a single endpoint.
Microsoft Defender
- Troubleshooting Microsoft Defender for Endpoint Sensor Issues
- Tenant ID showing blank
- Can Microsoft Defender For Endpoint Support Isolation?
- "Response Not Supported" button on Confirmed Threat page
- Microsoft Defender for Endpoint (formerly ATP) Showing in Red Canary as Unknown
- Does Microsoft Defender Antivirus connect with Red Canary?