App Control: What does the file 'ModifiedDate' field represent in third party file reputation monitoring/logging applications?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What is does the field 'ModifiedDate' represent in file details relating to file reputations in third party monitoring/logging applications?

Environment

• App Control (formerly CB Protection): All supported versions
• Splunk: All Supported versions
• File Reputation Service: All Supported versions

Resolution

The 'ModifiedDate' field indicated represents the last time the file metadata was updated in the App Control database. So for instance, if you were to receive threat and trust information about that file from the Carbon Black File Reputation service, the App Control database would be updated with the latest metadata about that file and indicate in that field when that information was updated.

Additional Information

• Keep in mind that when we see time and date information in the App Control console the time indicated can be from various time zones as well as UTC time which may not and typically does not match what is seen in the console
• This field can exist in any third party monitoring/logging application dependent upon on configuration and functionality