App Control: What Syntax to Use to Specify Approving Files With OnlyIF Macro and COMPANY Attribute.

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• This article contains the syntax for specifying the OnlyIF macro for COMPANY in a custom rule

Environment

• App Control Server: 8.0.x and Higher
• App Control Agent: 8.0.x and Higher

Resolution

• The three first fields need to be separated with colons
• The section in the first <> is the OnlyIf which doesn't support wildcards in the file path
• If the OnlyIf matches on the file then the PATHTO will be evaluated and this field does support wildcards

• <OnlyIf:Company:*Carbon Black*:<ProgramFilesx86>\bit9\parity agent\parity.exe>PATHTO\*.EXE