Computer Name Inclusion in Unapproved File Block Alert Subject Line

Products

• Carbon Black App Control

Issue/Introduction

Is it possible to add the hostname/computer name to the subject line of an alert for unapproved file blocks? 

Environment

• Carbon Black Application Control: All versions

Resolution

Hostname is only available for the Elevated Privilege alerts. 

Depending on the user case, an option may be to utilize a custom link in the notifier for unapproved blocks. This will used the mail client set in the OS to send an email to your IT department. Here's an example: 

1. Rules > Notifiers
2. Add Notifier
3. Copy Settings from one of the "Block executables"
4. Add a Notifer link like this.

   mailto:[e-mail]?subject=Blocked File <TargetName>&body=<UserName> on <DomainName>\<ComputerName>has reported block of <TargetName>.%0AFile details available at https://myappcserver.local/file-details.php?hash=<TargetSha256> <FriendlyText:Please click here to notify IT.>

5. Set each policy to use the custom notifier based on the type of block. 

Additional Information

Elevated Privilege: A computer remains in local approval mode longer than a specified time period. The default is one hour, but can be modified. No computer should remain in approval mode longer than is necessary to install software.