Cannot Approve An Execution Error When Creating a Custom Rule
search cancel

Cannot Approve An Execution Error When Creating a Custom Rule

book

Article ID: 377887

calendar_today

Updated On:

Products

Carbon Black App Control

Issue/Introduction

When trying to save an Expert Rule it fails with "Cannot Approve An Execution" error pop-up 

Environment

  • App Control Server: 8.10.x and Higher

Cause

This occurs when trying to include Approve actions to Execute operations.

Resolution

Approving and marking files as Installers should happen during file creation (or write operations), not during execution. Approving a file on execution will cause the Agent to stall operations every time the file is executed to allow for analysis in-line. This will lead to performance issues on the endpoint.

Instead, Files should be issued an Approval on write operations. This allows for

  • Analysis to occur once per file modification, rather than every time it's executed.
  • Analysis to complete before the file is executed, preventing Execution Blocks.

Additional Information