Carbon Black Cloud: In What Order are Policy Rules Processed by the Sensor?
search cancel

Carbon Black Cloud: In What Order are Policy Rules Processed by the Sensor?

book

Article ID: 287096

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

In what order are policy rules processed by the Sensor?

Environment

  • Carbon Black Cloud Console
  • Carbon Black Cloud Sensor: All Supported Versions

Resolution

Policies are processed by the sensor in the following order:
#Policy Action
1Ignore: Allow (no log) or Bypass 
2Allow: Allow & Log
3Terminate
4Deny

Additional Information

  • Sensor bypass disables all policy enforcement so the policy processing information above would not apply
  • Since we check first policies with terminate action first, policy action to terminate will trump deny, allow trumps terminate, etc.