Access official resources from Carbon Black experts
Version
7.2.2.1119 (Patch 2)
Issue
After upgrading to 7.2.2.1119 the "Write Action" drop down menu in custom rules shows as blank.
Symptoms
Blank "Write Actions" not allowing new creation of certain types of rules.
Cause
This is caused by a value not being changed during the upgrade process.
Solution
For current 7.2.2.1119 Patch 2 environments, this can be resolved by running a SQL script on your DAS database.
1. Stop the Carbon Black Protection Service (Bit9 Server Service)
2. Run the following command in your SQL Management Studio:
Use das
UPDATE shepherd_configs SET value = 0 WHERE name = 'RuleOperationVersion'
IF EXISTS( SELECT * FROM dbo.rules WITH (NOLOCK) WHERE op_type IN (0x00530, 0x00570, 0x18550, 0x18570) AND master_rule_id < 1 AND deleted = 0)
BEGIN
UPDATE dbo.rules SET op_type = op_type|0x100000 WHERE op_type IN (0x00530, 0x00570, 0x18550, 0x18570) AND master_rule_id < 1 AND deleted = 0
DECLARE @ruleId INTEGER
DECLARE ruleCur CURSOR FOR
SELECT rule_id FROM dbo.rules WHERE op_type IN (0x100530, 0x100570, 0x118550, 0x118570) AND master_rule_id < 1 AND deleted = 0
OPEN ruleCur
FETCH NEXT FROM ruleCur INTO @ruleId
WHILE @@FETCH_STATUS = 0
BEGIN
EXEC dbo.CreateChildRules @ruleId
EXEC dbo.SendRuleToAgent @ruleId
FETCH NEXT FROM ruleCur INTO @ruleId
END
CLOSE ruleCur
DEALLOCATE ruleCur
END
3. Start the Carbon Black Protection Service (Bit9 Server Service). The startup process to get into the Console can take a while as it processes the new rules.
Important Note(s)
Please do not make any other changes to the database, or run live queries, as this can cause unexpected results.
Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.