App Control: How to view Malicious File Instances via SQL

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Show all file instances with a threat of 'potential risk' or 'malicious' directly in SQL Management Studio

Environment

• App Control: All Supported Versions

Resolution

Use the following sample SQL query to obtain the file instances
 

use das;
SELECT * from bit9_public.ExFileCatalog FC with (NOLOCK)
JOIN bit9_public.ExFileInstances (NOLOCK) FI on FI.File_Catalog_Id = FC.File_Catalog_Id
where FC.Threat in ('2 - Malicious','1 - Potential risk')