App Control: What Fields Can the Certificate Macros be Used?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What fields can the following Macros be used?

• <CertSerial:>
• <CertIssuer:>
• <CertSHA1:>
• <CertMD5:>

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

The Certificate Macros can only be used within the hidden fields:

• Process Publisher
• File Publisher

Additional Information

• To enable those fields the Advanced Rule Options must be enabled in /support.php first.
• Using Certificate Macros in the File Publisher field of Custom Rules that use the Write option may cause performance issues.