App Control: New Rules Installers do not update default rule values that have been changed.
book
Article ID: 289071
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
If the default rules installed by a Rules Installer have been changed, updated, reorder, or modified by a user other than "SYSTEM", any future Rules Installer will NOT update those rules any longer.
Environment
App Control Server: 8.1.4 and Higher
Rules Installer: 1.4 and Higher
Cause
Once a default rule is modified by a user, it is now seen as a custom rule and the Rules Installer is designed to not affect any custom rules.
Resolution
Continue to manually update the non-default rules in the SQL database to match the information from the future Rules Installers as needed.
OR
Revert the custom changes made to the default rules, so they are back to their default configuration (including the "last_modified_by" value back to SYSTEM user ID value), and future Rules Installers will see them as matching default rules and update them with any applicable changes.