Carbon Black Cloud: How to Disable Core Prevention Rules

[#1]

Environment

• Carbon Black Console: April 2022 Release (0.77.x) and Higher
• Carbon Black Cloud Windows Sensor: 3.6.x.x and Higher
• Microsoft Windows: All Supported Versions

Objective

Provide steps for disabling individual Core Prevention rule-sets

Resolution

1. Go to Enforce > Policies > Prevention Tab
2. Expand Section “Core Prevention”
3. Click desired Core Prevention name

   Advanced Scripting Prevention (Windows AMSI)
   Emerging Threats
   Credential Theft
   Privilege Escalation
   Ransomware

4. Toggle blocking as desired

   "Alert only" OR "Block and Alert" Recommended

Additional Notes

The primary recommendation when a Core Prevention rule is causing a block is to create a Core Prevention exclusion, rather than disabling blocking.

Related Content

Endpoint Standard: How to Configure Exclusions for Core Prevention Rules
Endpoint Standard: What Is The Difference Between Allow, Allow & Log and Bypass?
Carbon Black Cloud: What are the differences between API Bypass and Full Bypass
CB Defense: What Happens With An API Bypass Rule and Additional Operation Attemps Are Added For The ...