Expert Rule to Block Reads Not Always Working

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Expert Rule with "Basic Operations > Read" and "Actions > Block" does not seem to always work.

Environment

• App Control Console: All Supported Versions

Cause

By default we optimize uninteresting reads by excluding processes that are not script processors when we are processing a fast I/O read or whenever it is not a removable device.

Resolution

This behavior can be changed by setting the agent_config "kernelFlags=0x20000"

Additional Information

We have not done any formal performance testing with this agent configuration. It should be tested thoroughly before rolling out.