CB Protection: Custom Rule User or Group Field Displays "No Results Found"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When creating a custom rule and specifiying a User or Group, dialog box displays: "No results found"

Environment

• CB Protection Console: All Supported Versions

Cause

• There are no events in the console under Reports > Events that match the specified group.
• There are no events in the console under Reports > Events that match the specified user.

Resolution

1. Continue creating the rule even if the box displays this message.
2. Test and confirm rule is working as expected

Additional Information

• The console relies on events within the console for the autocomplete feature
• Groups will never be found via autocomplete, due to groups never being shown in an event
• For more information on specifying a user or group, see page 410 of the User Guide