Local State of File Does Not Reflect Current Global State

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

File was recently Globally Banned, or a Global Ban was removed, but the Local State on an endpoint does not properly reflect the Global State

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions

Cause

The Local State in this situation is only updated upon execution of the file. Removing or adding a Global Ban from the Console does not immediately update the file's Local State.

Resolution

After adjusting the Global State in the Console:

1. The Agent must receive the Configlist entry containing the change.
2. On the next execution attempt the Agent will honor the Global State change
   • If the file was Banned, the Agent will enforce the ban and update the Local State accordingly.
   • If the file was Approved, the Agent will allow the execution and update the Local State accordingly.