App Control: Events Seen in console Despite Kernel Process Exclusion

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why are events being seen in the Console, despite a Kernel Process Exclusion in place to prevent these events being shown?

Environment

App Control: All Versions

Resolution

Events seen in the console, are Discovery events, as a result of a Cache Consistency Check, and NOT as the result of any File operations. This is expected

Additional Information

Check the description column to verify event was seen as part of a CCC (Cache Consistency Check)