App Control: Multiple Event Rules With "Move Computer" Action Causing Conflict

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Multiple event rules with the "Move computer" action specified
• Both event rules "Match" the event criteria correctly
• Device tries moving to both policies instead of the policy specificed in highest ranking event rule

Environment

• App Control: All Versions

Cause

This is currently expected behavior

Resolution

Ranking only determines the order that the event rules are processed. If multiple event rules "match" at the time they are processed- then they'll both attempt to move the device. Since event rules generally process in very quick succession to each other, this could mean that if the device hasn't completed/reported it's first move by the time the second rule processes- it'll fire and try to act on both rules.

Additional Information

Please file a feature request if you would like to see this behavior modified.