App Control: Receiving 'Malicious File Detected' Events for Banned or Approved Files

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Receiving 'Malicious File Detected' Events on files that have already been Banned, or Approved.

Environment

• App Control Server: All Supported Versions

Cause

Reputation of file has been updated in the CDC (CB Collective Defense Cloud). 

Resolution

There is no way to stop, or prevent the 'Malicious File Detected' Events from being generated, regardless if the file has been Banned or Approved.

Additional Information

• There is also no way to stop/prevent 'Malicious File Detected'  Events from being sent to a SIEM
• Filtering out these Events is performed on the Siem side. The Event Integration Guide provides details on the 'Event Fields' you can use in the Siem for filtering out these Events.
• Following Feature Request has been created to include 'Global File State' status in Syslog output:
  https://community.carbonblack.com/t5/Idea-Central/Include-Global-File-State-Status-in-Syslog-Output/idi-p/28767