App Control: How To Use OnlyIf Macros

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to properly format the OnlyIf Macro for use in Custom Rules.

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions

Resolution

The OnlyIf Macro should be formatted using: <OnlyIf:Condition:Pattern>

Examples:
<OnlyIf:ConnectedToServer:Yes>
<OnlyIf:HostName:*BSMITH-1*>
<OnlyIf:Company:*Carbon Black*:<ProgramFilesX86>\Bit9\Parity Agent\Parity.exe>

 

Additional Information

• The OnlyIf:Company example using wildcards would expand the OnlyIf Macro if the Company metadata was Carbon Black, Inc or VMware Carbon Black
• More OnlyIf Conditions and examples are available in the User Guide > Custom Software Rules > Specifying Paths and Processes > OnlyIf Macros.
• Additional OnlyIf logic is included here