Create a Performance Optimization Rule to Ignore File Modifications

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Create a Custom Rule for Performance Optimization to ignore all Read, Rename, Write, Write Delayed, and Delete operations.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

1. Log in to the Console and navigate to Rules > Software Rules > Custom > Add Custom Rule.
2. In the Rule Name field, enter the name with which you want to identify this Custom Rule
3. Choose the Platform you want this rule applied to (Windows, Mac, or Linux) 
4. Choose the Rule Type Performance Optimization.
5. Specify the Process(s) and File Path(s) relevant to this Performance Optimization Rule.
6. By default, all new Custom Rules are created with the Status set to Disabled. To have this take affect immediately set this to Enabled.
7. Save the new Custom Rule.

Additional Information

• Executions will still be monitored but Performance Optimization Rules will specify folders or files to avoid tracking writes.
• For Windows endpoints, a Procmon capture may be beneficial in determining specific combinations for Performance Optimization.