App Control: How to Prevent an Installer File from Having Promoted Child Files

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to break the typical promotion propagation from installer files to their child files

Environment

• App Control Console: All Supported Versions

Resolution

1. This can be accomplished using an 'Expert' rule type in Rules > Software Rules > Custom tab
2. Under 'Approval Actions', the 'Demote process' and 'Don't Promote Children' actions can be used to stop the approval propagation
3. Specify the process in question