"Max Exe delay" set above 60 seconds not working
search cancel

"Max Exe delay" set above 60 seconds not working

book

Article ID: 290170

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • Maximum delay on executable files while waiting on analysis never exceeds 60 seconds
  • Endpoint Standard Policy setting “Max Exe delay” with a value higher than 60 seconds is not honored on 3.7.x.x and earlier Sensors
  • Output of `repcli status` shows same value as Policy setting
    Example: "Max Exe Delay" set to 100 on Policy
    "C:\Program Files\Confer\RepCLI.exe" status | findstr MaxDelay
            APC[Enabled] RiskLevel[4] MaxSize[4194304 bytes] MaxDelay[100 sec]
  • Output of authenticated `repcli configprops` command shows value prior to being set higher than 60 seconds (default 45s)
    "C:\Program Files\Confer\RepCLI.exe" configprops | findstr ApcUploadMaxExeDelaySec
    40. ApcUploadMaxExeDelaySec=45

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard
  • Carbon Black Cloud Sensor: 3.2.x.x thru 3.7.x.x
  • Microsoft Windows: All Supported Versions

Cause

3.7.x.x and earlier Sensors not honoring "Max Exe delay" when set above 60 seconds

Resolution

Upgrade to 3.8.x.x or higher Sensor