Cannot Approve An Execution Error When Creating a Custom Rule

Products

• Carbon Black App Control

Issue/Introduction

When trying to save an Expert Rule it fails with "Cannot Approve An Execution" error pop-up 

Environment

• App Control Server: 8.10.x and Higher

Cause

This occurs when trying to include Approve actions to Execute operations.

Resolution

Approving and marking files as Installers should happen during file creation (or write operations), not during execution. Approving a file on execution will cause the Agent to stall operations every time the file is executed to allow for analysis in-line. This will lead to performance issues on the endpoint.

Instead, Files should be issued an Approval on write operations. This allows for

• Analysis to occur once per file modification, rather than every time it's executed.
• Analysis to complete before the file is executed, preventing Execution Blocks.

Additional Information

• If existing files need to be issued a Local Approval, consider instead retroactively issuing Local Approvals.
• Additional information and combinations to avoid can be found in What Custom Rules Should Be Avoided.