App Control: How to Verify the Process is Marked as an Installer?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to verify the process is marked as an installer in the console?

Environment

• App Control Console (formerly CB Protection): All Supported Versions

Resolution

1. Log into the App Control console
2. Navigate to Assets > Files 
3. Look for the file by Hash or by Name, adding the respective filters
4. Click on View details in file in question
5. Confirm it is marked as installer

Additional Information

• Linux files are not recognized as installers.
• Mac files recognized as installers are packages – files with .PKG extensions and properly defined archive headers. Because of this, using the Mark as installer feature might be particularly useful for these platforms
• Files identified as installers do transfer their approval status to files that they generate, if any
• When troubleshooting unexpected blocks compare the hash of the process in the block event, to the process marked as installer, as there may be different versions of the same file