App Control: What Does DiscoveredBy[USNRecord] Mean?
book
Article ID: 288389
calendar_today
Updated On: 10-20-2021
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
What does it mean when a file is DiscoveredBy[USNRecord]?
Environment
- App Control Console: All Supported Versions
Resolution
DiscoveredBy[USNRecord] indicates the file was discovered when the agent scanned the USN Change Journal.
Additional Information
https://docs.microsoft.com/en-us/windows/win32/fileio/change-journals
Feedback
Was this article helpful?
thumb_up
Yes
thumb_down
No