CB Protection: Health Check Warning "Has unexpected ApprovalReason"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agent Health Check warnings for files stating "has unexpected ApprovalReason"

Environment

• CB Protection Server: 7.x and Higher
• CB Protection Agent: 7.x and Higher

Cause

The agent has multiple approval reasons for the same hash.

Resolution

• There are two possible fixes:
  1. Perform a cache consistency check with the drop down set to "Full Scan for New Files". Reference the user guide for your version for steps on initiating the scan.
  2. Uninstall and re-install the Protection agent.

Additional Information

• These events are extremely low priority, if the agent/endpoint is not having issues, the alerts can safely be ignored.
• If you are having issues on the endpoint, please open a support case.