App Control: How to Hide Notifier Blocks on Local System Accounts

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to modify a notifier so that it does not appear for blocks from the Local System account (NT Authority\System or NT Authority\Local Service)

Environment

• App Control Console: All Supported Versions

Resolution

1. Navigate to Rules > Notifiers
2. Edit the notifier you'd like to not trigger for Local System
3. Add to the Notifier Text

   <NotfierBroadcastSystem>

4. And verify you have in the text:

   <NotifierBroadcastMessage>