App Control: New Rules Installers do not update default rule values that have been changed.

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

If the default rules installed by a Rules Installer have been changed, updated, reorder, or modified by a user other than "SYSTEM", any future Rules Installer will NOT update those rules any longer.

Environment

• App Control Server: 8.1.4 and Higher
• Rules Installer: 1.4 and Higher

Cause

Once a default rule is modified by a user, it is now seen as a custom rule and the Rules Installer is designed to not affect any custom rules.

Resolution

1. Continue to manually update the non-default rules in the SQL database to match the information from the future Rules Installers as needed.

OR

2. Revert the custom changes made to the default rules, so they are back to their default configuration (including the "last_modified_by" value back to SYSTEM user ID value), and future Rules Installers will see them as matching default rules and update them with any applicable changes.