Environment
- Carbon Black Cloud Console
- Carbon Black Cloud Sensor: All Supported Versions
Question
In what order are policy rules processed by the Sensor?
Answer
Policies are processed by the sensor in the following order:
| # | Policy Action |
|---|
| 1 | Ignore: Allow (no log) or Bypass |
| 2 | Allow: Allow & Log |
| 3 | Terminate |
| 4 | Deny |
Additional Notes
- Sensor bypass disables all policy enforcement so the policy processing information above would not apply
- Since we check first policies with terminate action first, policy action to terminate will trump deny, allow trumps terminate, etc.
Related Content
