Determine Which Rule Is Causing a Block

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To determine which rule is causing a file to be blocked.

Environment

• App Control Console: All Supported Versions

Resolution

1. Login to the App Control console
2. Add the "Rule Name" column:
   1. Navigate to Reports > Events
   2. Click on "Show Columns"
   3. Find "Rule Name" and move to the "Selected" section.
   4. Click Apply
3. Look at the "Rule Name" column for relevant block events