"Max Exe delay" set above 60 seconds not working
book
Article ID: 290170
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
- Maximum delay on executable files while waiting on analysis never exceeds 60 seconds
- Endpoint Standard Policy setting “Max Exe delay” with a value higher than 60 seconds is not honored on 3.7.x.x and earlier Sensors
- Output of `repcli status` shows same value as Policy setting
Example: "Max Exe Delay" set to 100 on Policy
"C:\Program Files\Confer\RepCLI.exe" status | findstr MaxDelay
APC[Enabled] RiskLevel[4] MaxSize[4194304 bytes] MaxDelay[100 sec]
- Output of authenticated `repcli configprops` command shows value prior to being set higher than 60 seconds (default 45s)
"C:\Program Files\Confer\RepCLI.exe" configprops | findstr ApcUploadMaxExeDelaySec
40. ApcUploadMaxExeDelaySec=45
Environment
- Carbon Black Cloud Console: All Versions
- Carbon Black Cloud Sensor: 3.2.x.x thru 3.7.x.x
- Microsoft Windows: All Supported Versions
Cause
3.7.x.x and earlier Sensors not honoring "Max Exe delay" when set above 60 seconds
Resolution
Upgrade to 3.8.x.x or higher Sensor
Feedback
thumb_up
Yes
thumb_down
No