Collecting Agent Logs for Rules Not Working (Windows)
book
Article ID: 290714
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Steps to collect Agent diagnostics for unexpected Custom Rule behavior.
Environment
App Control Agent: All Supported Versions
Microsoft Windows: All Supported Versions
Resolution
For rules that are User/Group specific: Log in as that user for the reproduction. As well, run this command as the user and provide the output to the case
Collect a CSV export of the Events reported by the Agent to in the Console by going to: Reports > Events.
Set the Saved View & Group By to (none)
Set the Max Age accordingly.
Be sure the Columns: Installer, Process, Rule Name, and User are included in the Columns.
Set the Filter to the relevant Source (Computer).
Click Export to CSV.
Capture a full screenshot of the entire Custom Rule, including all fields/sections.
Upload all collected data.
Additional Information
The Windows command "sc control parity 128" is only available in command prompt and not in PowerShell, the command will cause the custom rules to re-expand on the agent.
If the issue cannot be reproduced this level of detail will not provide the insight required and a separate process for capturing diagnostic information may be required.