File Approval Events Logged Despite Full OS Inventory Tracking Set To Discard
book
Article ID: 290826
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Full OS Inventory Tracking setting is configured to discard information at the Server or Agent (Option 2 or 3).
Agents are still sending Local File Approval Events for newly written/discovered supporting files (e.g. DLLs).
Supporting files are properly signed by Microsoft Windows or Microsoft Corporation and fully validated.
Environment
App Control Agent: 8.7.6+
App Control Console: All Supported Versions
Microsoft Windows: All Supported Versions
Cause
This issue is caused by two different defects:
Previously: Publisher matching did not properly associate these files with Microsoft Corporation or Microsoft Windows (fixed in Agent 8.9.2 with EP-18819).
Currently: FileTypeis not correctly set on dll file (TBD, tracked under CBEP-20515/CRE-17903).
Resolution
Add a temporary ABExclusion Rule to suppress all Approved files signed by Microsoft Corporation or Microsoft Windows:
Verify the Agent(s) in question are on version 8.9.2 or higher.
Log in to the Console and navigate to: https://ServerAddress/shepherd_config.php