Verify Wildcards and Macros In Paths

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to use the Agent to verify the Macro or Wildcard will expand to correctly match the desired path on the endpoint.

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions
• Microsoft Windows: All Supported Versions
• Linux OS: All Supported Versions
• MacOS: All Supported Versions

Resolution

Reminders: This command will require authenticating with the Agent. The full file or path must exist on the endpoint already in order to properly compare and match. The testpattern command must be formatted as follows: dascli testpattern "Custom Rule Path" "Existing Path on Endpoint" OnlyIf Macros must follow expected formatting and otherwise be valid Example: no wildcards inside the Filename Argument of a Macro.

 

Using testpattern With Wildcard or Path Macros:

1. Use a command prompt or Terminal to switch into the Agent directory and authenticate via dascli or b9cli, example:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword

2. Use the testpattern command to compare the Custom Rule path against the existing path on the endpoint, example:

   dascli testpattern "<CommonAppData>Acme Accounting\*.dll" "C:\ProgramData\Acme Accounting\math.dll"

3. Review the results and verify the Expanded Pattern and Normalized Filename match, example:

   Expanded Pattern: \\?\globalroot\device\harddiskvolume3\programdata\acme accounting\*.dll
   Normalized Filename: \\?\globalroot\device\harddiskvolume3\programdata\acme accounting\math.dll
   Match

Using testpattern With OnlyIf Macros:

1. Use a command prompt or Terminal to switch into the Agent directory and authenticate via dascli or b9cli, example:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword

2. Use the testpattern command to compare the OnlyIf Macro accordingly, example:

   dascli testpattern "<OnlyIf:HostName:*BSMITH-1*>C:\Windows\System32\WindowsPowerShell\*powershell*.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"

3. Review the results and verify the Expanded Pattern and Normalized Filename match, example results due to a mismatch in hostname:

   Failed to expand pattern: HostName

Additional Information

• Using Wildcards in App Control
• Using OnlyIf Macros in App Control