The Home Page is a dashboard, a configurable page on which you can add and delete portlets containing information or controls.

See Using and Customizing Dashboards for more details on how to use and modify the Home Page and other dashboards. The following table describes the default contents of the Home Page.

Note: The Home Page can be modified, so your Home Page may have different portlets:
Table 1. Home Page Quick Access Portlets

Portlet

Links/Buttons

Description

Alerts

Reset/Reset All Alerts

Shows any triggered Carbon Black App Control Alerts that have not been reset, and provides a Reset button for each so you can clear them if you choose. It also provides links from each alert to its Alerts History page for more details about that alert.

Top X

Search/Clear

Shows a table of the top items in various categories – for example, the 10 computers with the most blocked files in the past day. You can specify the number of items to show (default is 10) and the time period over which to look for them (default is 1 day). In the results, clicking on a name (e.g., a computer name) opens a details page for that item. Clicking on a number usually displays the Events page filtered to show events matching your Top X query.

Find Files or Events

Search/Clear

Finds files and events (file blocks, unapproved files, or all events) associated with computers, users or file names you specify. For file name searches, when the "Exact Match" box is checked, only that single file is listed in the results (if found). When the box is not checked, all files containing the string you enter in the box are listed in the results. The Max Age dropdown allows you to determine the time period over which to conduct the search; it defaults to “Last Day”.

Event Reports

 

New installations

Displays a table of all new file installations that have taken place during the past day (24 hours up to the time you display the page) on Windows computers managed by this Carbon Black App Control Server.

Platform Note: Installations on Mac systems are not included in this New installations table. However, the files that are installed appear in tables that show new files.

New unapproved files

Displays a table of all new unapproved files that have appeared on computers managed by this Carbon Black App Control Server during the past day (24 hours up to the time you display the page).

Blocked files (by bans)

Displays a table of all banned files that have been blocked on computers managed by this Carbon Black App Control Server during the past day (24 hours up to the time you display the page).

Blocked files (by unapproved status)

Displays a table of all new, unapproved files that have been blocked as a result of the Unapproved Executables setting. The report covers one day (24 hours up to the time you display the page).

Licensing

Manage your licenses

Displays the total number of Carbon Black App Control Agent licenses available on your server and the number in use. If some licenses are for Visibility and some for Control, shows the number for each type.

Clicking the Manage your licenses link opens the Licensing panel of the System Configuration page, where you can add Carbon Black App Control licenses, and can configure and activate Carbon Black File Reputation.

Find Computer

Search/Clear

Entering a string that matches all or part of the name or IP address of a computer running an Carbon Black App Control Agent displays a list of matching computers. If you click on a computer in the results, its Computer Details page appears. Computer details include currently Enforcement Levels and connection status. Tabbed views also show details such as last logged in user, agent version, and System Details (if available).

Computer name searches are not case sensitive.

Change Policy

Change/Clear

Changes the current security policy of a specified computer. Enter the name or IP address of the computer whose policy you want to change in the upper box. Its current policy is shown. Enter the policy you want to change to in the lower box. Once you click Change, the computer moves to the new policy and stays there unless you explicitly move it again.

Emergency Lockdown

Lockdown/Restore

Lockdown switches all connected computers managed by this Carbon Black App Control Server to High (Block Unapproved) Enforcement Level. Placing computers in High Enforcement Level during high-threat periods helps ensure that no new executable files are permitted to run.

When computers are under emergency lockdown, Restore returns them to their pre-lockdown state. If they were in High Enforcement Level prior to the emergency lockdown, they remain in that state.

Lockdown does not affect systems that are in Local Approval mode.

If you do not have any Carbon Black App Control licenses, Lockdown is disabled, but Restore is still available in case machines were locked down at a time when you did have full licenses.