AppControl: How to Determine What User Created a New Console User

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

This article provides how to filter on the event generated when a new console user was created in the AppControl/CB Protection console.

Environment

AppControl: All Supported Versions

Resolution

1. In the AppControl console, navigate to Reports > Events
2. Clear any saved views, and click Show Filters to add "Subtype" "is" "Console user created"
3. Set the "Max Age" value to "3 months"
4. Click Apply
5. If the event appeared within the timeframe and was not previously pruned out of the AppControl database, the event showing the creation of a user should be visible, including which console user had created the new console user