CB Protection: Incorrect user listed as enabling or disabling an event rule
search cancel

CB Protection: Incorrect user listed as enabling or disabling an event rule

book

Article ID: 288820

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Incorrect user listed as "Last Modified By" when enabling or disabling from the Event Rule Console Page. 
  • Event triggered for the rule modification shows incorrect user. 
  • Editing the rule directly works as intended.

Environment

  • CB Protection Server: 8.0.x
  • Changes made from Event-Rules.php

Cause

The cause is an incorrect PHP value being passed to the database update call. 

Resolution

  1. On the CB Protection Server navigate to C:\Program Files (x86)\Bit9\Parity Console\WebUI\html\
  2. Edit the file event-rules.php
  3. Before line number 89 add the code:
$user = $GLOBALS['B9User'];
$eventRules->last_modified_by_id = $user->user_id;
  1. Save the changes. 
  2. Open an administrative command prompt. 
  3. Run the following command to restart IIS to commit the changes:
IISReset