Carbon Black Cloud: When testing a policy rule with Test Rule, an error is returned "your query is invalid."
book
Article ID: 288226
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
When testing a policy rule, user types in the criteria (ie path), and directly clicks on "Test Rule" without saving and confirming, this pop up error appears:
"Test Rule: not a valid query."
Environment
Carbon Black Cloud Backend: 1.x
Carbon Black Cloud Sensors: All versions
Cause
The rule was not first saved and confirmed.
Resolution
One can save and test a policy rule by creating a new test policy, and saving the rule there to avoid testing in a production policy.