App Control: Execution Events Are Not Showing in Console for Specific File(s)

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Execution events are not reported for specific file(s)

Environment

• App Control Console (formerly CB Protection): All Supported Versions

Cause

Approved files of any type generally do not create events of their execution, outside of first execution

Resolution

Create a custom rule to report executions from files already approved in the console:

1. On the Parity console, go to Software Rules and click on Custom.
2. Click on Add Custom Rule.
3. Set up the rule with the following:
   • Name: Give the rule a label
   • Description: a brief description that this rule is for reporting the specific file
   • Status: Enabled
   • Rule Type: Execution Control
   • Execution Action: Report
   • Path or File: specific path
     • *path in question*
   • Process: Any Process
   • Rule Applies to: All policies
4. Click Save