How to See Who Modified or Changed a Policy

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• How to see who modified a policy from within the console, and when this happened.
• Seeing when a computer was moved from one policy to another.

Environment

• App Control: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. In the console, navigate to Reports > Events.
2. Add a column for 'Subtype' and click Apply.
3. Add a filter for 'Subtype' 'is' 'Policy modified', and click Apply.
4. Set the Max Age to 3 months for maximum visibility and click Apply.
 

Additional Information

• This will show who modified a policy and when, but it will not show what was actually changed in most cases.
• To view when an endpoint enforcement level or policy was changed add the Subtype = Computer modified
• Further information on using the Reports > Events view can be found in the User Guide for each App Control version.