CB Protection: How to Determine Who Added a User

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to determine who added a specific admin/user to the CB Protection web console

Environment

CB Protection Web Console: All Versions

Resolution

1. Navigate to Reports > Events
2. Reset any current filters
3. Ensure the Columns for 'User' and 'Description' are enabled
4. Apply new filter for: 

   Subtype = Console User Added

5. The events that populate below should show an entry for every User/Admin ever added to the console

Additional Information

If no results show, try changing the setting for Max Age to none.