App Control: What Does DiscoveredBy[USNRecord] Mean?
Article ID: 288389
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
What does it mean when a file is DiscoveredBy[USNRecord]?
Environment
- App Control Console: All Supported Versions
Resolution
DiscoveredBy[USNRecord] indicates the file was discovered when the agent scanned the USN Change Journal.
Additional Information
https://docs.microsoft.com/en-us/windows/win32/fileio/change-journals
Feedback
Yes
No
Powered by
