App Control: Why Are Files Showing As Unapproved, When Certificate And Publisher Are Approved?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why are files showing as Unapproved, when the Publisher and related Certificates are showing as Approved?

Environment

• App Control Server: All Supported Versions

Resolution

The Approval of a file is the combination of both Local and Global states, including whether Approved by Certificate or Publisher. A file showing as Unapproved indicates there is no File Rule created to issue an Approval to its hash. Globally, the file will run, as its Certificate is Approved, as is its Publisher. If a File Rule were to be created that banned this hash, then the Ban would take precedence over the Certificate and Publisher Approvals, and the file would be considered "Banned".

A Publisher Approval or Certificate Approval alone does not automatically issue a File Approval for a hash. App Control will be able to block the file should the Certificate or Publisher of the file be revoked or unapproved at a later date.