App Control: How To Use Macros to Look For a Specific Hash

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Setup a rule to match for a specific hash. 

Environment

• App Control Server: 8.x and Higher

Resolution

In the Path or File section of the policy use something similar to 
<OnlyIf:HashExists:1c94cd9e3ee959ff6002eca3c5e7e7fdb9158657>

Additional Information

• Page 394 of the user guide has the "Using Macros in Rules" section