Export a CSV of Events From the Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to collect a CSV of Events from the Console.

Environment

• App Control Console: All Supported Versions

Resolution

There are many ways to filter and sort the Events prior to export. Popular requests by Support will be Events for Execution Blocks or Unapproved Files, examples:

Execution Blocks:

1. Log in to the Console and navigate to Reports > Events.
2. Choose the Saved View: Blocked Files (All) and set the following options:
   1. Max Age: Adjust accordingly
   2. Show Columns: include Process Path > Apply.
   3. Filter: Source > is: <relevant computer>
   4. Click Apply
3. Click Export to CSV

Unapproved Files:

1. Log in to the Console and navigate to Reports > Events.
2. Choose the Saved View: New Files (Unapproved) and set the following options:
   1. Max Age: Adjust accordingly
   2. Filter: Source > is: <relevant computer>
   3. Click Apply
3. Click Export to CSV

All Events:

If desired, or specifically requested, a full list of Events for a relevant machine could be exported:

1. Log in to the Console and navigate to Reports > Events.
2. Choose the Saved View: (none) and set the following options:
   1. Max Age: Adjust accordingly
   2. Filter: Source > is: <relevant computer>
      • Additional Filters could be added for Subtype, Timestamp, Process Name, etcetera
   3. Click Apply
3. Click Export to CSV