App Control: Carbon Black File Reputation Reporting Slow Synchronization

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Slow synchronization reported with the Carbon Black File Reputation service
• Filename and/or pathname table(s) will show increase in size

Environment

• App Control Console: All Supported Versions
• Carbon Black File Reputation service

Cause

• ABExclusionRules' rule added to Server is not configured properly
• Max character length of the ABExclusionRules' rule is reached 

Resolution

Warning: Editing AbExclusions can affect the data sent to and from the agents. If unsure on the edits, please contact Carbon Black technical support

ABExclusionRules' rule added to Server is not configured properly:

1. Navigate to https:// <SERVERNAME>/support.php?tab=abex&menu
2. Validate that all of the listed AbExclusions, match the formatting requirements in the description box
3. Correct any mistakes found and click save

Max character length of the ABExclusionRules' rule is reached 

1. On older releases (Pre-8.x) the value for AbExclusions after encryption is 2048 characters. Query the following values to validate the number is less than 2048

select len(value), name from dbo.shepherd_configs (nolock) where name like '%ABExclusion%'

2. If a value is over the 2048 character limit, decrease the number of exclusions within the https:// <SERVERNAME>/support.php?tab=abex&menu table

Additional Information

•  2048 is the max character length of the 'ABExclusionRules' rule within older releases