App Control: How To Reset CPE and CVE Data

[#1]

Environment

• App Control Server: 8.10.2 and higher
• Microsoft SQL Server: All Supported Versions

Objective

How to fully reset all tables containing CPE and CVE data.

Resolution

1. Run SQL Server Management Studio as the Carbon Black Service Account and connect to the das database.
2. Click New Query and execute the following:

   USE das
   GO
   
   TRUNCATE TABLE dbo.cpe_applications;
   TRUNCATE TABLE dbo.cpe_application_antibody_map;
   TRUNCATE TABLE dbo.cpe_dictionary_items;
   TRUNCATE TABLE dbo.cpe_dictionary_items_helper;
   TRUNCATE TABLE dbo.cpe_unmatched_applications;
   TRUNCATE TABLE dbo.cpe_cve_lookup_table;
   TRUNCATE TABLE dbo.cpe_cve_id_lookup_table;
   
   TRUNCATE TABLE dbo.cve_dictionary_items;
   TRUNCATE TABLE dbo.cve_dictionary_items_helper;
   
   UPDATE dbo.shepherd_configs SET value = scd.value
   FROM dbo.shepherd_configs sc
   INNER JOIN dbo.shepherd_configs_defaults scd ON sc.name = scd.name
   WHERE sc.name IN
   ('CPEApplicationGenerationConnectionTimeout', 'CPEApplicationGenerationConnectionTimeout2', 'CPEDBCommandConnectionTimeout', 'CPEDelayBetweenRequests', 
   'CPEDictionaryURL', 'CPEEnabled', 'CPEFirstSync', 'CPELastApplicationGeneration', 'CPELastApplicationPrune', 'CPELastMatching', 'CPELastQueryDate', 
   'CPELastQueryIndex', 'CPELastQueryStatus', 'CPELastUnsuccessfulQuery', 'CPETotalResults', 'CVEFirstSync', 'CVELastQueryDate', 'CVELastQueryIndex', 
   'CVELastQueryStatus', 'CVELastUnsuccessfulQuery', 'CVETotalResults')

3. Return to the Console > Assets > Applications > CPE Applications and CVE Instances.
4. Verify the data is removed before configuring the feature again.

Additional Notes

• The library from NIST will need to be downloaded again after completing this, which will take time.
• The App Control Server will need to complete matching between the CPE data and the file catalog, this will take time.