VMware Carbon Black App Control Events Guide v8.6

[#1]

Document Version: 1.0
Date: February, 2021

This document describes the events generated, tracked, and stored by Carbon Black App Control, syslog output formats, and other ways you can access these events.

Note: This document applies to all 8.6.x versions.

See the Comments below for changes in this version.

[BFortin]

Change log for Carbon Black App Control 8.6 Events Guide.pdf (changes since the 8.5.4 version):

1. Updated Frontmatter version and Copyright date.
2. On page 8, updated the following sentence under File Events:
   • Old: File State provides the global state of the file associated with the event (Approved/Unapproved/Banned) and File State Reason provides additional details behind the global state of the file associated with the event
   • New: File State provides the state of the file associated with the event (Approved/Unapproved/Banned) and File State Reason provides additional details behind the state of the file associated with the event.
3. Updated Event Types and Subtypes on page 9.
   • Added two new event subtypes to support custom rule read events:
     • Read block (Custom Rule)   'Execution block(custom rule)' and 'Write block(custom rule)' event now show the correct operations when the reading of the file has been blocked.
     • Report read (Custom Rule)    Reports the event:
       File '$pathname$$pathSeparator$$filename$' was read.
   • Made several minor text changes to various event descriptions for consistency and clarification.
4. On page 33, in Table 4, fixed broken link to Table 2.
5. On page 33, in Table 4, added two new syslog fields:
   • Prevalence
   • Global_state

Updated subsequent examples to reflect the new fields.

6. On page 49, updated definition for GLOBAL_STATE.  Added option for Banned.
7. Minor editing and formatting changes were made that had no impact on content meaning.