While the Carbon Black App Control Server keeps a global state for a file, each instance of a file on a computer running the Carbon Black App Control Agent has its own Local State, which indicates what the file is allowed to do on the computer it was found on, depending upon its Enforcement Level.
Files with a Global State of Unapproved may have different local states. In particular, you can locally approve a file by various methods, as long as that file was not globally banned. Carbon Black App Control includes local file state information in its Files on Computers inventory of all tracked file instances.
A file can have a local state of:
- Approved
- Banned
- Unapproved
- Deleted(the file has been deleted recently and will be removed from the database on next update)
In addition to its primary state, each file instance has Local File Details (see File, Publisher, and Application Information) that may identify the source of its approval or other decisions made about it in Carbon Black App Control. These details are primarily use by Carbon Black Support.
