Determine Which Rule Is Causing a Block
search cancel

Determine Which Rule Is Causing a Block

book

Article ID: 289200

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To determine which rule is causing a file to be blocked.

Environment

  • App Control Console: All Supported Versions

Resolution

  1. Login to the App Control console
  2. Add the "Rule Name" column:
    1. Navigate to Reports > Events
    2. Click on "Show Columns"
    3. Find "Rule Name" and move to the "Selected" section.
    4. Click Apply
  3. Look at the "Rule Name" column for relevant block events