Managing the Linux System Performance Rapid Config

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to enable and configure the Linux System Performance Rapid Config.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Linux: All Supported Versions

Resolution

1. Log in to the Console and navigate to Rules > Software Rules > Rapid Configs.
2. Click View Details (pencil icon) for Linux System Performance.
3. Change the Status to Enabled.
4. Enable & configure the relevant sections (ex: GCC, Chef, Puppet) accordingly.
   • Avoid adding:
     • Files that should be executed.
     • Processes that are responsible for software updates.
     • Processes that should have all operations tracked.
5. If desired, configure the Rapid Config differently per-Policy
   1. At the bottom of the Rapid Config > Settings Apply To > Selected Policies.
   2. Choose the relevant Policies.
   3. Click Add settings for additional Policies.
   4. Adjust the Rapid Config accordingly for the different Policies.
6. Click Save & Exit.

Additional Information

• Files that are expected to execute should not be added to this Rapid Config.
• Processes that write new interesting (executable) files, are responsible for system updates, or should otherwise be monitored should not be added to this Rapid Config.