App Control: Unable To Delete ABExclusions in 8.10.0+
search cancel

App Control: Unable To Delete ABExclusions in 8.10.0+

book

Article ID: 288526

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Delete button is unavailable¬†
  • Unable to remove ABExclusions from the App Control Console

Environment

  • App Control Console: 8.10.0+

Cause

The "delete" icon is invisible due to CSS changes.

Resolution

  1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
  2. Select the Property: ABExclusionRules
  3. Copy the full Value to a text editor to make adjustments easier.
  4. Note, individual ABExclusions are separated by the pipe symbol (vertical bar), example:
    Current Value:
    ;????????.???.ps1,*-????-????-????-*.ps1,__psscriptpolicytest_*.???.ps1;;;;;;;;;3|;;;;;Microsoft Corporation,Microsoft Windows;;;;E0;7|;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3
  5. Remove the relevant ABExclusion, and replace the Value in the Shepherd Config Property, example:
    New Value:
    ;????????.???.ps1,*-????-????-????-*.ps1,__psscriptpolicytest_*.???.ps1;;;;;;;;;3|;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3
  6. Click Change.
  7. Re-visit the /support.php > ABExclusions page and verify the changes show correctly.
NOTE: Extreme care should be taken in adjusting these manually. Improper adjustments could cause the Agents to not send File and/or Event information back to the Server.