App Control: What Happens When an Agent Is Disconnected or the Server Is Offline?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What happens on the endpoint when the Agent cannot communicate with the Server, such as during a Server upgrade or other communication outage?

Environment

• App Control Agent: All Supported Versions
• App Control Server: All Supported Versions

Resolution

• Agents will not be able to receive new Rules, Approvals, Bans, Agent Management, or any other data that would involve communication with the Server.
• Agents will continue to enforce according to Policy settings (Rules > Policies > relevant Policy > Disconnected Enforcement). By default Disconnected and Connected Enforcement are the same.
• Agents will store up to 5,000 Events locally, and send the Events once the connection is restored.

Additional Information

Should the 5,000 Event threshold be reached; Agents will purge Health Check and Informational type Events from the local cache before purging Block and Malware related Events.