App Control: Execution Events Are Not Showing in Console for Specific File(s)

[#1]

Environment

• App Control Console (formerly CB Protection): All Supported Versions

Symptoms

Execution events are not reported for specific file(s)

Cause

Approved files of any type generally do not create events of their execution, outside of first execution

Resolution

Create a custom rule to manual report executions from files already approved in the console:
Steps to create a report rule:

1. On the Parity console, go to Software Rules and click on Custom.
2. Click on Add Custom Rule.
3. Set up the rule with the following:
   • Name: Give the rule a label
   • Description: a brief description that this rule is for reporting the specific file
   • Status: Enabled
   • Rule Type: Execution Control
   • Execution Action: Report
   • Path or File: specific path
     • *path in question*
   • Process: Any Process
   • Rule Applies to: All policies
4. Click Save

 

Related Content

CB App Control: How to track allowed executions in medium enforcement