Rule Trigger Count Not Updating

Products

• Carbon Black App Control

Issue/Introduction

• Rule trigger count isn't updating
• Block and/or approval happened but count has not incremented

Environment

• App Control Agent: 8.11.x+
• App Control Server: 8.12.x+

Cause

• Agent not updated to 8.11.0+
• Policy and/or rule does not have the tracking enabled
• Agent has not yet sent data and/or server has not yet processed it

Resolution

1. Confirm the agents in the environment are Windows Agent Version 8.11.0+
   • Linux and macOS is not currently supported
   • Agent versions below 8.11.0 do not have this functionality
2. Navigate to Rules > Policies
   • Within the policy details page, confirm the policy that the agent is in has the "Track Rule Triggers" box selected.
3. Navigate to Software Rules and open the Files, Custom, Memory, or Registry tab
   
   • Confirm the "Trigger Tracking" column shows the rule as enabled
4. Confirm the appropriate amount of time has passed since the rule has triggered
   • Agents send data on a 24 hour schedule
   • Server processes data on a 60 minute schedule
5. If the behavior still occurs, gather agent logs, database logs, and open a 'Technical' support case.