Troubleshooting Still Analyzing Blocks
search cancel

Troubleshooting Still Analyzing Blocks

book

Article ID: 286774

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agent is enforcing Block Events similar to:

File 'C:\Program Files (x86)\AcmeAccounting\acme.exe' [A3292...4D511] was blocked because Carbon Black App Control Agent did not have time to analyze it.

Environment

  • App Control Agent: All Supported Versions
  • App Control Console: All Supported Versions

Cause

These events occur when the Agent hasn't finished analyzing a file that is being executed. These are expected and all machines will encounter these from time to time and just one or several blocks on a machine during a short period of time is unlikely to have an impact. They are typically only problematic if:

  • They are recurring.
  • The file is deleted and doesn’t try to run again.
  • The end user is impacted from the Block Event.

Resolution

  1. Verify the Agent Exclusions are present in any other antivirus/security software on the endpoint.
  2. Verify the latest version of the Agent is installed to eliminate the potential this is related to a known issue.
  3. Verify any applicable Rapid Config  (ex: Microsoft SCCMWindows App Store) or Updater is already enabled & configured.
  4. In some situations an Execution Control (Allow) type Custom Rule may be necessary.
    • This will let the file run even if the Agent does not know what it is at execution.

Additional Information

If the issue persists, capture the Agent Interoperability Logs on Windows and open a case with Support.