App Control: How To Create Kernel FileOp Exclusion for Ivanti 'detectionScript' File

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to create kernel fileop exclusion for Ivanti 'detectionScript' file from Lumension.

Environment

• App Control Console: All Versions
• App Control Agent: All Versions

Resolution

1. Open following URL: https://<app_control_servername>/agent_config.php
2. Select "Add Agent Config"
3. Enter following information:

a. Property Name: Kernel FileOp exclusion for Ivanti 'detectionScript'

b. Host ID: 0

c. Property Value: kernelFileOpExclusions=/opt/patchagent/update/bin/detectionScript:2094975

d. Platform: Linux

e. Status: Enabled

f. Create For: All Current and Futures Policies

4. Select Save

Additional Information

• Adding this 'kernelFileOpExclusions' parameter will exclude all operations processed by the App Control Agent driver (except Execute+ScriptExecute)