Ignore Directory During Initialization

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to ignore directories during Initialization and Cache Consistency Checks.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

Warning: Ignoring files during Initialization will prevent the Agent from knowing about these files. This could result in unexpected blocks or a potential performance issue. Executing a file from a local volume will be slower if the Agent must discover & analyze it on execution.

 

1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
2. Click Show Filters > Add Filter > Value > Begins with: cc_ignore_patterns=
   • If an Agent Config exists it can be added to by clicking the Edit (pencil) icon. Example:

     Value: cc_ignore_patterns=*.vmhd,*.vmhdx,*.bigfile

   • Alternatively a new Agent Config can be created to target a specific endpoint, Policy, Platform, or combination of those options. Example:

     Name: Initialization Ignore - User Downloads
     Host ID: 0
     Value: cc_ignore_patterns=C:\Users\*\Downloads\*
     Platform: Windows
     Status: Enabled
     Create For: Selected Policies > Desktops-HE
     

Additional Information

• Test on single endpoint first to validate configuration. Make the path directory as specific as necessary.
• Typically this setting is used to ignore large files (or directories with large numbers of files) that would not be expected to otherwise execute.
• Executing a file from a local volume will be slower if the Agent must also discover & analyze it on execution.