AppControl: How to Determine What User Created a New Console User
book
Article ID: 289441
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
This article provides how to filter on the event generated when a new console user was created in the AppControl/CB Protection console.
Environment
AppControl: All Supported Versions
Resolution
In the AppControl console, navigate to Reports > Events
Clear any saved views, and click Show Filters to add "Subtype" "is" "Console user created"
Set the "Max Age" value to "3 months"
Click Apply
If the event appeared within the timeframe and was not previously pruned out of the AppControl database, the event showing the creation of a user should be visible, including which console user had created the new console user