How to Make a New File Type Interesting
Article ID: 285232
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Instructions on how to make a new file type interesting to track and monitor.
Environment
- App Control Console: All Supported Versions
Resolution
To make a new file type interesting:
1. In the console menu, go to Rules > Software Rules, and on the Software Rules page, click the Scripts tab
2. Click the "Add Script Rule" button
3. In the Rule Name field, enter the name you want to appear on the list of rules. Description is optional
4. Choose a Platform and select Script Type and Process for the "Script Definition"
5. Enter the "Script Type" (usually the asterisk followed by a dot and the file extension)
6. Enter the process that interacts with the files in the "Script Process" field
7. Check "Rescan Computers" to add the new rule to your agents
8. Click the Save button to save the rule
9. The rule now appears on the Script Rules page but keep in mind that if the hash changes a block will be received until a custom rule is added for it
2. Click the "Add Script Rule" button
3. In the Rule Name field, enter the name you want to appear on the list of rules. Description is optional
4. Choose a Platform and select Script Type and Process for the "Script Definition"
5. Enter the "Script Type" (usually the asterisk followed by a dot and the file extension)
6. Enter the process that interacts with the files in the "Script Process" field
7. Check "Rescan Computers" to add the new rule to your agents
8. Click the Save button to save the rule
9. The rule now appears on the Script Rules page but keep in mind that if the hash changes a block will be received until a custom rule is added for it
Additional Information
Now that the new files are interesting, they will need approved or allowed with a rule in the policy that is being used by the Agent.
Feedback
Yes
No
Powered by
