Carbon Black Cloud: When testing a policy rule with Test Rule, an error is returned "your query is invalid."

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

When testing a policy rule, user types in the criteria (ie path), and directly clicks on "Test Rule" without saving and confirming, this pop up error appears:

"Test Rule: not a valid query."

Environment

• Carbon Black Cloud Backend: 1.x
• Carbon Black Cloud Sensors:  All versions

Cause

The rule was not first saved and confirmed.

Resolution

One can save and test a policy rule by creating a new test policy, and saving the rule there to avoid testing in a production policy.