App Control: How to view Malicious File Instances via SQL
book
Article ID: 288534
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Show all file instances with a threat of 'potential risk' or 'malicious' directly in SQL Management Studio
Environment
App Control: All Supported Versions
Resolution
Use the following sample SQL query to obtain the file instances
use das; SELECT * from bit9_public.ExFileCatalog FC with (NOLOCK) JOIN bit9_public.ExFileInstances (NOLOCK) FI on FI.File_Catalog_Id = FC.File_Catalog_Id where FC.Threat in ('2 - Malicious','1 - Potential risk')