Reset CPE and CVE Data

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to fully reset all tables containing CPE and CVE data.

Environment

• App Control Server: 8.10.2 and higher
• Microsoft SQL Server: All Supported Versions

Resolution

1. Run SQL Server Management Studio as the Carbon Black Service Account and connect to the das database.
2. Click New Query and execute the following:

   USE das
   GO
   
   TRUNCATE TABLE dbo.cpe_applications;
   TRUNCATE TABLE dbo.cpe_application_antibody_map;
   TRUNCATE TABLE dbo.cpe_dictionary_items;
   TRUNCATE TABLE dbo.cpe_dictionary_items_helper;
   TRUNCATE TABLE dbo.cpe_unmatched_applications;
   TRUNCATE TABLE dbo.cpe_cve_lookup_table;
   TRUNCATE TABLE dbo.cpe_cve_id_lookup_table;
   
   TRUNCATE TABLE dbo.cve_dictionary_items;
   TRUNCATE TABLE dbo.cve_dictionary_items_helper;
   
   UPDATE dbo.shepherd_configs SET value = scd.value
   FROM dbo.shepherd_configs sc
   INNER JOIN dbo.shepherd_configs_defaults scd ON sc.name = scd.name
   WHERE sc.name IN
   ('CPEApplicationGenerationConnectionTimeout', 'CPEApplicationGenerationConnectionTimeout2', 'CPEDBCommandConnectionTimeout', 'CPEDelayBetweenRequests', 
   'CPEDictionaryURL', 'CPEEnabled', 'CPEFirstSync', 'CPELastApplicationGeneration', 'CPELastApplicationPrune', 'CPELastMatching', 'CPELastQueryDate', 
   'CPELastQueryIndex', 'CPELastQueryStatus', 'CPELastUnsuccessfulQuery', 'CPETotalResults', 'CVEFirstSync', 'CVELastQueryDate', 'CVELastQueryIndex', 
   'CVELastQueryStatus', 'CVELastUnsuccessfulQuery', 'CVETotalResults')

3. Return to the Console > Assets > Applications > CPE Applications and CVE Instances.
4. Verify the data is removed before enabling Common Platform Enumeration again.

Additional Information

• The library from NIST will need to be downloaded again after completing this, which will take time.
• The App Control Server will need to complete matching between the CPE data and the file catalog, this will take time.