App Control: What are "File * would have blocked if the rule was not in Report Only mode." Events?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What are the "File * would have blocked if the rule was not in Report Only mode." events? Why do they occur?

Environment

• App Control Console 

Resolution

• Creating a Ban (Report Only) rule allows observing how a ban might affect users
• With a report-only ban, the file is not blocked but would-have-blocked and would-have-terminated warnings are written to the Events log
• If certain this is a file that needs to be blocked from executing, it's possible to change the rule to a full Ban