App Control: Why Are Files Showing As Unapproved, When Certificate And Publisher Are Approved?
book
Article ID: 286434
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Why are files showing as Unapproved, when the Publisher and related Certificates are showing as Approved?
Environment
App Control Server: All Supported Versions
Resolution
The Approval of a file is the combination of both Local and Global states, including whether Approved by Certificate or Publisher. A file showing as Unapproved indicates there is no File Rule created to issue an Approval to its hash. Globally, the file will run, as its Certificate is Approved, as is its Publisher. If a File Rule were to be created that banned this hash, then the Ban would take precedence over the Certificate and Publisher Approvals, and the file would be considered "Banned".
A Publisher Approval or Certificate Approval alone does not automatically issue a File Approval for a hash. App Control will be able to block the file should the Certificate or Publisher of the file be revoked or unapproved at a later date.