CB Protection: Performance Impact on Scanning in ScanStudio.exe

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Starting Scans is slower than anticipated. 
• Scans containing multiple pages are slower to scan. 

Environment

• CB Protection: All Supported Versions
• Scan Studio 

Cause

This is caused by an excessive number of temporary files which the agent is hashing, causing minor delays on each. 

Resolution

1. Navigate to your console's agent_config.php URL

   https://SERVERNAME/agent_config.php

2. Create a new configuration value
3. Set the following values
   • Name:

     Kernel Exclusion - Scan Studio

   • Host ID:

     0 or the device specific Host ID

   • Value

     kernelProcessExclusions=*\Apps\ScanStudio.exe:1919

   • Status

     Enabled

4. Save and test the performance after the device has received the change

Additional Information

The configuration allows the device to ignore the following operations by ScanStudio.exe

• Open
• Read
• Write
• Delete
• Rename