App Control: What Are The Scan Options For Cache Consistency Checks?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What do each of the scan options entail when running a Cache Consistency Check?

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions

Resolution

• Quick Verification: Confirms that each file in the agent's cache exists, verifies that it is still an executable file that should be tracked, and compares the size of each file on disk to the size stored in its cache the last time the file was analyzed. If a file no longer exists, it is removed from the cache. If any of the other checks fail, the file is re-analyzed. 
• Rescan Known Files: Does everything in the Quick Verification, plus compares the hash of each file on disk to the same file’s hash in the agent cache. If the hash does not match, the file is re-analyzed. 
• Full Scan for New Files: Does everything in the previous two levels, plus rescans the entire disk, looking for files that should be in the agent cache, but are not. Analyzes any file found.