VMware Carbon Black App Control User Guide v8.6

[#1]

Document Version: 1.1

Date: February, 2021

This document provides information for administrators, incident responders, and others who will operate the VMware Carbon Black App Control Console. It describes how to use Carbon Black App Control, including:

• How to use the App Control Console
• Server configuration
• Agent installation
• Computer and file management
• Rule creation
• Monitoring features

Note: This document applies to all 8.6.x versions.

See the "Before you begin" chapter for a complete list of topics discussed in the document.

See the Comments below for changes in this version.

[BFortin]

Change log for Carbon Black App Control 8.6 User Guide.pdf (changes since the 8.5.4 version):

1. A change in authoring tools, styles, and formatting resulted in larger PDF page count. 
   Online Help version has better user experience including a Google-like search result.
2. Updated Copyright content.
3. User Guide is now applicable to all versions of 8.6.x.
   New versions will not be created for patches.
4. On page 13, a new topic called, “Admonitions” was added.  This lists the new criteria and formatting used for warnings, notes, tips, and examples.
5. On page 14, under “Related Documentation,” added a new link to the Carbon Black Doc Repository on the User Exchange.
6. On page 42, in Chapter Using the Console, updated Browser Recommendations.
7. On page 89, in Chapter Using the Console, added a new topic regarding Feedback Banners.
   Note: This is not new functionality in 8.6.0, it is merely adding new content to increase coverage.
8. On page 126, in Table 12: Permissions Settings for User Roles in the chapter: Managing Console Login Accounts, added a new column named Dependencies.
9. On page 130, in Table 12: Permissions Settings for User Roles in the chapter: Managing Console Login Accounts, changed permission name:
   • Old name: Manage application updaters and configurations
   • New name: Manage Updaters and Rapid Configs
10. On page 152, in the topic Installation and Initialization within the chapter, Managing Computers, updated the line regarding when agent initialization begins.  The line now states:
       File initialization begins in either of the following cases:
    • As soon as the agent software is installed into a visibility-mode or control-mode policy.
    • If the agent is moved from a disabled-mode policy to a visibility-mode or control-mode policy.
11. On page 219, in the topic Computer Details within the chapter, Managing Computers, updated the Connection Status description:
    • Gray: Disconnected
    • Yellow: Connected, out of date (agent out of date, requires reboot, or other reasons)
12. On page 773, updated Table 75: Rapid Configs.  Added the following:
    • Linux System Performance
    • Microsoft Teams
    • Suspicious Application Protection
    • Suspicious Command Line Protection A-M
    • Suspicious Command Line Protection N-Z
    • Suspicious Parent-Child Protection
    • Windows Installer Embedded File Protection
13.  On page 944, updated Table 91: Alert Fields to include an up to date list of Mail Templates.
14.  On page 946, updated Table 91: Alert Fields to include a NEW Criteria Event Alert that allow the user to specify how often to alert within a specified time period.
15. Minor editing and formatting changes were made that had no impact on content meaning.