App Control: Shouldn't Rules For Blocking Files In A Low Enforcement Policy Be Set To Report And Not Active?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Shouldn't the policy rules for blocking files in a Low Enforcement policy be set to Report, and not Active?

Environment

• App Control Server: All Versions

Resolution

No, the policy rules should still be set to Active, even for a Low Enforcement policy. The enforcement level will determine how the rules behave (report in Low Enforcement, prompt in Medium Enforcement, block in High Enforcement).