Managing ABExclusion Rules

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to add or remove ABExclusions in the environment.

Environment

• App Control Console: All Supported Versions
• App Control Windows Agent: All Supported Versions
• App Control Linux Agent: Version 8.7.16+
• App Control macOS Agent: Version 8.9.0+

Cause

• Adjusting ABExclusion Rules are done to reduce data from Events, Files, or both from being sent back to the Server.
• This can reduce network traffic, Server load, and help reduce database growth.

Resolution

CAUTION! Malformed or incomplete ABExclusions could cause Agents to stop sending data for all Events, Files (or both). ABExclusions should only be used when specifically instructed by Support. If possible, a better idea may be to adjust the Custom Rule to not send Events or File Data.

 

ABExclusion Formatting:

• Each exclusion follows the pattern:

  PathNames;FileNames;ProcessNames;Hashes;UserNames;PublisherNames;HostGroups;eventSubtype;requiredReportABFlags;prohibitedReportABFlags;exclusionFlags

• ExclusionFlags should always be specified to prevent a malformed/incomplete ABExclusion causing no Event/File Data to be sent.
• Every field (except Flags and Event Subtype) can be a comma-delimited list of strings.
• ABExclusions are separated by the pipe character, example:

  ;????????.???.ps1,*-????-????-????-*.ps1,__psscriptpolicytest_*.???.ps1;;;;;;;;;3|;;;;;Microsoft Corporation,Microsoft Windows;;;;E0;7

Adding or Removing ABExclusions:

1. Log in to the Console and navigate to https://ServerAddress/support.php > ABExclusions
2. Use the Exclusion Filters to add relevant exclusion pattern for the Event, File, or Process patterns.
3. From the Add Filter dropdown, choose Exclusion Flags.
4. Check either: Exclude Files, Exclude Events, or both.
5. Click Add Rule.
6. In the top grey bar, confirm the new rule has been added, and is formatted correctly.
   • If correct, click Save.
   • If incorrect, click Reset.

Additional Information

• Some examples of popular ABExclusions:
  • Server Backlog Caused by .NET Activity
  • Event Backlog Caused by Certificate Checked Events
  • Event Backlog Caused by Session Change Events
• When specifying a directory in an AB Exclusion:
  • Folder\ will only apply to that specific folder
  • FolderName\* will apply to all subfolders but not the specific folder FolderName\
  • For both the specific folder and all subfolders an exclusion for FolderName\ and FolderName\* will need to be added, example:

    TheDirectory\,TheDirectory\*;;TheProcess.exe;;;;;;;;3

• Max length for ABExclusion is: 2048 Characters, to confirm the length the following SQL Query can be executed:
  

  USE das;
  SELECT * FROM dbo.config_list (nolock) WHERE data LIKE '%exclude_abs_new%' ORDER BY version DESC;