App Control: What Are The Scan Options For Cache Consistency Checks?
book
Article ID: 286792
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
What do each of the scan options entail when running a Cache Consistency Check?
Environment
App Control Agent: All Supported Versions
App Control Console: All Supported Versions
Resolution
Quick Verification: Confirms that each file in the agent's cache exists, verifies that it is still an executable file that should be tracked, and compares the size of each file on disk to the size stored in its cache the last time the file was analyzed. If a file no longer exists, it is removed from the cache. If any of the other checks fail, the file is re-analyzed.
Rescan Known Files: Does everything in the Quick Verification, plus compares the hash of each file on disk to the same file’s hash in the agent cache. If the hash does not match, the file is re-analyzed.
Full Scan for New Files: Does everything in the previous two levels, plus rescans the entire disk, looking for files that should be in the agent cache, but are not. Analyzes any file found.