IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

App Control: Why is Event Rule Not Restoring All Endpoints to Normal Enforcement?

App Control: Why is Event Rule Not Restoring All Endpoints to Normal Enforcement?

Environment

  • App Control Agent (formerly CB Protection): All Supported Versions
  • App Control Console (formerly CB Protection): All Supported Versions

Question

Why is the event rule is not restoring the endpoints to normal enforcement?

Answer

  • Each Event Rule is designed to work with one trigger at a time
  • If multiple endpoints are moved from Normal to Local Approval at the same time, only one endpoint will count as the trigger
  • Only the triggered endpoint will be moved back to Normal Enforcement
  • Move each endpoint individually, and this way the agent will trigger an Alert per endpoint

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-09-2021
Views:
334
Contributors