Create a Performance Optimization Rule to Ignore File Modifications

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Create a Custom Rule for Performance Optimization to ignore all Read, Rename, Write, Write Delayed, and Delete operations.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

WARNING: Performance Optimization Rules should avoid: Including Processes that write Interesting (executable) files with Any Path. Including File Paths that end with a wildcard or backslash, as this will be recursive for all files and folders. These types of combinations could prevent the Agent from seeing the Create/Write of an Executable file, and prevent Local Approvals of such files. Additionally, when Interesting files are discovered on execution it will force the Agent to stall operations while analysis is completed in-line. This will cause a greater impact to performance in this situations. Instead: Use a Specific Path and specify the exact non-interesting File Patterns to exclude.

1. Log in to the Console and navigate to Rules > Software Rules > Custom.
2. Click Add Custom Rule and enter initial details, example:
   • Name: Accounting Software PO Rule
   • Description: Ignore writes to non-interesting files that cause performance impacts during report building.
   • Status: Enabled
3. Define the new Custom Rule, example:
   • Platform: Windows
   • Rule Type: Performance Optimization
   • Path or File: Specific Path

     C:\Program Files (x86)\AccountingSoftware\tmp\accounting-tmp.gdb

   • Process: Specific Process

     C:\Program Files (x86)\AccountingSoftware\reportbuilder.exe

   • Policies: Selected Policies > Desktops-Accounting
4. Save the new Custom Rule.

Additional Information

• Executions will still be monitored but Performance Optimization Rules will specify folders or files to avoid tracking writes.
• For Windows endpoints, a Procmon capture may be beneficial in determining specific combinations for Performance Optimization.