VMware Carbon Black Application Control: Application Control Blocks Endpoint Standard Files

[#1]

Environment

• VMware CB Application Control: All Versions
• VMware CBC Endpoint Standard: All Versions

Symptoms

App Control Block notification(s) for CBC Endpoint File(s)

Cause

CBC Endpoint Files have not been globally approved.

Resolution

1. Manually approve current block(s)
2. Enable CB Defense Updater
   1.  Console > Rules > Software Rules > Updaters > CB Defense > Enable.

Additional Notes

• There is no need to add a Performance Optimization(PO) Rule to the APP Control Agents. Adding a PO Rule would prevent CB Defense Updater from seeing the writes of the files