Files Missing From the "Files on Computers" Page in the Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• No File instances displayed on the "Files on Computers" page of the console
• Files do not appear under the File Catalog or Computer Details page
• Missing events with subtype "New file on network" or "New unapproved file to computer"

Environment

• App Control Server: All Versions

Cause

• In the Policy settings the "Track File Changes" checkbox has not been selected
• Incorrectly formatted AB Exclusion rule has been added

Resolution

1. Open the Policy details page and ensure the "Track File Changes" checkbox is selected
2. Navigate to the "https://<cb protection server>/shephard_config.php" page
3. Open the "ABExlusionRules" property > Search for any rules having event subtype as the only argument, e.g.

   ;;;;;;;801;;;3

4. Change the rule to:

   ;;;;;;;801;;;2

Additional Information

If an incorrect ABExlusion rule has been added already, then a file resynchronization of all agents is needed to remediate the missing file instances