Access official resources from Carbon Black experts
The most common symptom of this issue is a block occurring with no file hash present in the event in the console.
This occurs when the agent does not have time to properly analyze a file. This is typically caused by latency on the endpoint; network or third party antivirus being the most common root cause.
Here is a list of agent configuration properties we typically recommend to clients for this scenario:App Control: Allow Inaccessible FilesApp Control: Allow Deleted Files for AnalysisCb Protection: Approve Inaccessible Files based on Last Known StateApp Control: Unanalyzed block timeout for local files