Blog Viewer

App Control: How To Reset CPE and CVE Data

By CB_Support posted Apr 05, 2024 12:26 PM

  

Environment

  • App Control Server: 8.10.2 and higher
  • Microsoft SQL Server: All Supported Versions

Objective

How to fully reset all tables containing CPE and CVE data.

Resolution

  1. Run SQL Server Management Studio as the Carbon Black Service Account and connect to the das database.
  2. Click New Query and execute the following:
    USE das
    GO
    
    TRUNCATE TABLE dbo.cpe_applications;
    TRUNCATE TABLE dbo.cpe_application_antibody_map;
    TRUNCATE TABLE dbo.cpe_dictionary_items;
    TRUNCATE TABLE dbo.cpe_dictionary_items_helper;
    TRUNCATE TABLE dbo.cpe_unmatched_applications;
    TRUNCATE TABLE dbo.cpe_cve_lookup_table;
    TRUNCATE TABLE dbo.cpe_cve_id_lookup_table;
    
    TRUNCATE TABLE dbo.cve_dictionary_items;
    TRUNCATE TABLE dbo.cve_dictionary_items_helper;
    
    UPDATE dbo.shepherd_configs SET value = scd.value
    FROM dbo.shepherd_configs sc
    INNER JOIN dbo.shepherd_configs_defaults scd ON sc.name = scd.name
    WHERE sc.name IN
    ('CPEApplicationGenerationConnectionTimeout', 'CPEApplicationGenerationConnectionTimeout2', 'CPEDBCommandConnectionTimeout', 'CPEDelayBetweenRequests', 
    'CPEDictionaryURL', 'CPEEnabled', 'CPEFirstSync', 'CPELastApplicationGeneration', 'CPELastApplicationPrune', 'CPELastMatching', 'CPELastQueryDate', 
    'CPELastQueryIndex', 'CPELastQueryStatus', 'CPELastUnsuccessfulQuery', 'CPETotalResults', 'CVEFirstSync', 'CVELastQueryDate', 'CVELastQueryIndex', 
    'CVELastQueryStatus', 'CVELastUnsuccessfulQuery', 'CVETotalResults')
  3. Return to the Console > Assets > Applications > CPE Applications and CVE Instances.
  4. Verify the data is removed before configuring the feature again.

Additional Notes

  • The library from NIST will need to be downloaded again after completing this, which will take time.
  • The App Control Server will need to complete matching between the CPE data and the file catalog, this will take time.


#AppControl
0 comments
0 views

Permalink