Prune files that have Zero Prevalence from the database/File Catalog. These are files that were previously seen at least once, but currently meet the following conditions:
No copies of the file currently exist in the environment.
There are no Approvals or Bans created for the file.
The file is not part of any File Instance Groups or File Groups.
The file is not part of any Snapshots.
By default these files are not removed from the database/File Catalog and the information is retained indefinitely.
Environment
App Control Server: All Supported Versions
Resolution
Finding Total Files Eligible for Prevalence Pruning:
The attached script (ZeroPrevalencePruneScope.sql) can be used to determine the number of files that meet Zero Prevalence in the environment.
Run SQL Server Management Studio as the Carbon Black Service Account.
Paste the contents of the SQL Script into a new query.
Edit line 15 accordingly, example:
SET @maxAgeDays = 90;
Note the result for Total Files Eligible for Pruning. This will be the total files that meet the criteria above.
If the Scope is ran again on the next day (to track progress), increment @maxAgeDays accordingly, example:
SET @maxAgeDays = 91;
Configuring Zero Prevalence Pruning:
Decide how many days to keep a file after it no longer exists.
Log in to the Console & navigate to https://YourServer/shepherd_config.php
In the drop down, find the Property: PurgeAntibodiesPeriodDays
Set Property Value to the amount of days determined in Step 1 (example: 90).
The DailyPruneTask will execute at night and will prune files that meet all conditions for Zero Prevalence within the PurgeAntibodiesPeriodDays specified.
Additional Information
Note: Before implementing this, it's recommended to discuss with a dedicated security team and consider the loss of the file hash information and related events.
If the DailyPruneTask is unable to complete all Zero Prevalence tasks during the allotted time (6 hours by default), it will automatically pause and resume the following night.
The Shepherd Config Property, PurgeAntibodiesThresholdMin can be used to limit the time spent on Zero Prevalence Pruning. This may be necessary in larger environments to allow pruning tasks associated with DailyPruneTasks to execute.