CB Protection: ATI exception rules work until the rule is edited

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

After editing a working ATI (Advanced Threat Indicator) exception rule, the rule may no longer be enforced

Environment

• CB Protection Server: All 8.x versions
• CB Protection Agent: All 8.x versions

Cause

Issue CBPTC-8148 will occur when the ATI rule is edited, but the change is not applied when saved.

Resolution

To work-around this issue, and change an ATI rule:

1. Delete the existing ATI exception rule from the CB Protection console
2. Create a new rule with the change build in.
3. Save