Viewing Agent Block Events Locally On Endpoints

Products

• Carbon Black App Control

Issue/Introduction

What are the steps to review Block Events locally on endpoints?

Environment

• App Control Agent: All Supported Versions

Resolution

Regardless of platform, if the Notifier is not installed Events will not be logged (or displayed) locally.

Windows:

Block Events will be written by the Carbon Black App Control Agent Notifier in Event Viewer.

1. Open Event Viewer and navigate to Windows Logs > Application
2. From the right-hand menu > Actions > Filter Current Log...
3. Event Source > Carbon Black App Control Agent Notifier > OK
4. Review or export the logs accordingly.

macOS/Linux:

Currently unless reviewed via the Notifier it is not possible to historically view the Block Events.