CB Protection: What is the Difference Between "Promote Process" and "Promote Target Process"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When creating an Expert rule, what is the difference between "Promote Process" and "Promote Target Process"?

Environment

• CB Protection Console: 7.2.3 And Higher
• Rules with the type Expert

Resolution

• Promote Process will promote the process that's performing the operation that triggered the rule. This will cause files written by this process to be locally approved, and new processes spawned by this process with also be promoted. 
• Promote Target Process will promote the target of the operation, not the parent that triggered the rule. Note that this will only apply when the operation "Create Process" takes place.

Additional Information

For further information regarding rule types and actions please see Table 70 "Action and Settings in Expert Rules" in the most recent User Guide.