This page is an aggregate of all OER topics onto a single page for more convenient HTML viewing.

App Control Server: Supported Operating Systems

Operating System Architecture Service Pack Additional Notes/Requirements
Windows Server 2012 R2 x64 Use Latest If virtual, HVM only
Windows Server 2016 x64 Use Latest If virtual, HVM only
Windows Server 2019 x64 Use Latest If virtual, HVM only
Windows Server 2022 x64 Use Latest If virtual, HVM only
Note: Only the US English version is supported.

App Control Server: Cloud Deployments

The App Control server can be deployed within cloud services. VMware Carbon Black has successfully deployed App Control to Amazon Web Services, Microsoft Azure, and Google Cloud, and can support the product in that environment.

App Control can also be deployed to other cloud providers however, we have not validated deployment with our own internal testing. We will provide best level of effort in supporting customers when deploying to these cloud services but we cannot guarantee success. If provisioned cloud storage is validated with the CBPTest Tool, we anticipate a successful deployment in that environment.

Note: You can find information regarding the CBPTest Tool in the latest version of the SQL Server Configuration Guide.

App Control Database: Supported SQL Server Versions

Database System Architecture Service Pack / Cumulative Update
SQL Server 2012 x64 Use Latest
SQL Server 2014 x64 Use Latest
SQL Server 2016 x64 Use Latest
SQL Server 2017 x64 Use Latest
SQL Server 2019 x64

Use Latest

Important: Installation of the latest Cumulative Update is required.

(This is due to new feature in SQL Server 2019, inlining scalar-valued user-defined functions, which causes major issues without the latest Cumulative Update.)
SQL Server 2022 x64

Use Latest

Important: Installation of the latest Cumulative Update is required.

App Control Web Server Platform: Support Server

Common Requirements

In the IIS Roles Manager, verify the following configuration:
  • Common HTTP Features:
    • Static Content
    • Default Document
    • HTTP Errors
    • HTTP Redirection
  • Application development:
    • ASP.NET (version 4.5)
    • .NET Extensibility (version 4.5)
    • CGI
    • ISAPI Extensions
    • ISAPI Filters
  • Health and Diagnostics:
    • HTTP Logging
    • Logging Tools
    • Request Monitor
    • Tracing
  • Security:
    • Request Filtering
  • Performance: None
  • Management Tools:
    • IIS Management Console
    • IIS Management Scripts and Tools
  • FTP Publishing Service: None

Restrictions

Beginning with v8.0.0, the console relies on the App Control API. An incorrectly configured IIS server can prevent console access.

To confirm API functionality, in your current App Control console, go to System Configuration > Advanced Options, and check the “API Access Enabled” box. If a green dot appears next to the checkbox, then you can assume that IIS is configured correctly. Otherwise, make sure you meet the following restrictions:
  • Site Bindings:

    The App Control API will not connect to localhost if the console web application is bound to a specific IP address instead of ‘*’. Make sure that ‘*’ is added to the list of bindings.

  • IP Address and Domain Restrictions:

    If you must limit console access to specific IP addresses, be sure that the IPv6 localhost address is added to the list.

  • Application Pools:

    App Control must be run within the DefaultAppPool application pool. Using a different app pool results in the App Control server not having the appropriate credentials to access the SQL Server database.

  • Authentication:

    You must disable Basic Authentication and Windows Authentication so that the App Control Server handles authentication. Otherwise, users will not be able to log into the App Control Server.

Supported Versions
Version Part Of OS Supported Architecture Supported Level Additional Notes/Requirements
IIS 8.5 Windows Server 2012 R2 only x64

Common Requirements and Restrictions are listed in the table above.

Additional requirements: Private memory for IIS should be increased to 800 MB.
IIS 10 Windows Server 2016 / 2019 / 2022 x64

Common Requirements and Restrictions are listed in the table above.

Additional requirements: Private memory limit for IIS should be removed (set to 0).

App Control Console: Supported Browsers

Browser Version Additional Notes/Requirements
Microsoft Edge Latest Windows only
Mozilla Firefox Latest Windows, Mac or Linux
Google Chrome Latest Windows, Mac or Linux
Safari Latest Mac

App Control Server System Requirements

  • Clean operating system installation, with the latest version/patch/service pack.
  • Microsoft IIS:  Version corresponding to the Windows Server installed. Configured as described in the Installing App Control Server guide.
  • Microsoft .NET: Version 4.8 framework with latest patch level.
  • Microsoft Installer: Version 5.0 or newer.
  • Processor:  Intel Xeon/i7 processor/multi-core running at least 2.5 GHz. Although Intel processor is recommended, it is possible to use equivalent AMD processor.
  • Ethernet connection: 1 Gbps or faster connection required.

App Control Server Architecture by Endpoint Count

The App Control Server should be deployed on a single computer that will house both the App Control Server and SQL Server. The following tables list the requirements for this computer.

Table 1. Bare Metal
Endpoints Logical Processors (Note 1) RAM GB Disk Space TB (Note 2)
Up to 40,000 (Note 4) 2 12 2
40,001 to 70,000 6 32 4
70,001 to 90,000 8 48 8
90,001 to 110,000 16 64 8
Table 2. VMware vSphere (Note 3)
Endpoints Logical Processors (Note 1) RAM GB Disk Space TB (Note 2)
Up to 40,000 2 16 2
40,001 to 60,000 6 32 4
60,001 to 70,000 8 48 4
Table 3. Microsoft Azure
Endpoints Platform Disk Space TB (Note 2)
Up to 50,000 Standard_L8s_v2 2
50,001 to 80,000 Standard_L16s_v2 4
80,001 to 120,000 Standard_L32s_v2 8
Table 4. Amazon Web Services
Endpoints Platform Disk Space TB (Note 2)
Up to 50,000 i4i.Large 2
50,001 to 80,000 i4i.xLarge 4
80,001 to 90,000 i4i.2xLarge 8
90,001 to 110,000 i4i.4xLarge 8
110,001 to 120,000 i4i.8xLarge 8
120,001 to 130,000 i4i.16xLarge 8
Table 5. Google Cloud
Endpoints Platform Disk Space TB (Note 2)
Up to 30,000 n2d-standard-2 2
30,001 to 60,000 n2d-standard-4 4
60,001 to 80,000 n2d-standard-8 4
80,001 to 100,000 c2d-highmem-16 8

Notes:

1 "Logical Processors" represents the product of the number of cores and the number of threads per core.

2 The baseline setup represented by these numbers is SQL Server Standard Edition 2019 using NVMe drives. (For bare metal deployments, this must be direct-attached storage.) If you use a version of SQL Server Standard Edition prior to 2016 SP1, you may not be able to support as many agents on the same platform, and you may need more disk space, or you may need to upgrade to SQL Server Enterprise Edition.

3 The baseline hypervisor for these numbers is VMware ESXi 7.0.2, 18426014.

4 For deployments of 100 agents or fewer, SQL Express may be used instead of SQL Standard. It will require two logical processors, 4 GB of RAM, 10 GB of disk space for the data file, and an additional 10 GB for the log file.

Important: You should test your architecture using the information in “Using the CBPTest Tool - Disk Performance Testing Tool” in the document VMware Carbon Black App Control SQL Server Configuration Guide.

Associated with the storage sizes listed above are the following caveats:

  • By default, the App Control Server saves no more than four weeks of events and no more than ten million events. Increasing these defaults will increase the size of the database. Under normal circum­stances, the largest portion of the database will be taken up with storage of instances of files on endpoints.
  • The App Control Server carries out two scheduled database tasks described in the document VMware Carbon Black App Control SQL Server Configuration Guide. Stopping these tasks can cause the database to grow beyond the sizes listed above.
  • The steps listed under “Database Growth” in the document VMware Carbon Black App Control SQL Server Configuration Guide are followed.

Notes on SQL Server Editions

Consider the following information about SQL Server editions:

  • Unlike SQL Server Enterprise, SQL Server Standard prior to SQL Server 2016 SP1 does not use data compression.
  • On SQL Server Standard, App Control achieves equivalent performance processing file inventory compared to SQL Server Enterprise. However, the App Control console can be 30% slower and some database maintenance tasks such as rebuilding indexes and statistics will be slower. This can be mitigated by placing the database on faster storage hardware.

Two-tier Deployment Architecture

Here are the requirements for a two-tier installation of App Control where the App Control Server and SQL Server reside on separate hardware:

  1. For the SQL Server hardware, use the single-tier table above.
  2. For the App Control Server hardware, use the following table:
    Endpoints Hardware
    RAM GB CPU Cores (Note 1)
    Up to 1,000 4 2
    1,001 - 80,000 8 4
    Above 80,000 16 8

    Note:

    1 CPU core requirements are based on physical, not hyper-threaded cores. Two CPUs might be necessary to reach the required number of cores.

  3. Make sure that the network latency between the App Control Server and SQL Server is 0.7 ms or lower. The freeware utility hrPing or similar can be used to validate the latency.
  4. The SQL server instance and underlying database storage must be dedicated to the App Control Server.

App Control Database: SQL Storage Requirements

The SQL database should meet the following requirements:

  • The OS and paging file must be on a separate physical partition from the SQL database.
  • Any AV software must be configured to exclude SQL data directories.
  • Performance of SQL storage should be validated with the CBPTest tool prior to deployment of App Control Server.
  • Carbon Black recommends an NVMe x8 MU Card from any major vendor, according to the following description:
    • NVMe: non-volatile memory express
    • x8: motherboard PCIe 3.0 or 4.0 - x8 interface
    • MU: mixed use
    • Card: usually a half height form factor, which looks like a graphics card
  • For recommendations on how to split your database files among different partitions or drives, see the Database Files topic of the VMware Carbon Black App Control SQL Server Configuration Guide.

App Control Database: SQL Memory Configuration

Since the App Control Server database is relatively large, SQL Server will take all the RAM it has at its disposal, potentially leading to system memory starvation. For that reason, a SQL Server memory cap should always be set on SQL Server. On systems with 16 GB RAM, set the memory cap to 12 GB. For systems with more RAM, make sure that the SQL maximum server memory is set to at least 5 GB less than the total RAM installed in the system for SQL Server Standard, and 10 GB for SQL Server Enterprise edition.

App Control Database: SQL Maintenance

App Control Server does its own scheduled SQL DB Maintenance tasks on daily and weekly basis. This functionality is important in order to maintain database performance and limit growth. The maintenance tasks include:

  • Deleting obsolete data
  • Defragmenting indexes
  • Rebuilding statistics
Note: Use of any other, custom maintenance tasks would be counter-productive and should be avoided.

App Control Database: SQL Backups

The App Control database uses the “Simple” recovery model. The “Full” recovery model should not be used to avoid a performance penalty and excessive database log growth.

Note: The use of a SQL Server Availability Group Listener has been verified as a valid Database Server option during App Control Server installation. Design and implementation of a SQL Server Always On availability group is outside the scope of this document.

App Control Server supports automated database backups, but only for deployments up to 100 endpoints. In all other cases, full database backups should be done using best SQL server practices. Also, a database consistency check should be done prior to backup to ensure that the database is not corrupt.

Recommended backup frequency is 2-3 full backups per week. More frequent backups might negatively impact server performance.

Database backup can take minutes or hours to run, depending on database size, network speed (when backups are sent over the network) and performance backup storage. Backups impact server performance should be avoided during busy times (for example, when many users rely on console performance), or during internal App Control Server maintenance times (see table below).

Maintenance Task Times
Daily Cleanup Task Every day at 12 AM (midnight), App Control Server local time. Task can run from between 1 to 4 hours.
Database Index Maintenance Every Saturday starting at 3 AM. Task can run from between 2 to 6 hours.

App Control Server: Virtualization

App Control supports the use of virtualized environments for its deployment. Virtual environments must meet the minimum hardware configurations listed in the tables above, and also must meet the following requirements:

  • VMware ESXi hypervisor 7.0.2 and up; recommend patching to current level
  • SQL and App Control Server must be installed on the same virtual machine
  • Memory must be allocated as “reserved”
  • For virtualized servers, the underlying disk architecture must still meet aforementioned minimum requirements. Physical DAS storage, solely dedicated to the App Control VM, is preferred, but SAN storage may be used instead, if it meets these criteria:
    • IO channel: Fibre channel
    • Sequential write latency: 0.85ms or faster
      • Measured as 40kb writes, one thread, over two hours
    • Random write latency: 1.75ms or faster
      • Measured as 8kb writes, 32 threads, over two hours

App Control Server: Common Performance Pitfalls

There are several pitfalls when purchasing and configuring hardware for the App Control Server. This section lists most common mistakes.

Category Problem Explanation Possible Mitigations
Slow SQL Storage Misconfigured or slow storage used for SQL database files can significantly impact the ability of the server to process agent events and file changes and can cause a backlog of server tasks and slow console response.
  1. Use direct-attached storage with correctly sized disks and RAID architecture
  2. Avoid using SAN storage due to high latency
  3. For larger deployments, use fast SSD/Flash storage, as documented
Slow Network A slow network connection between the App Control Server and SQL Server can significantly impact the ability of the server to process agent events and files. This can cause a backlog of messages and loss of visibility into the agent inventory and operation.
  1. Deploy App Control in a 1-tier model, with both the App Control server and SQL Server on the single machine
  2. Reduce network latency between App Control and SQL server by using fewer, faster switches, or a direct cable connection
Resource Sharing Shared SQL server or SQL storage layer can impact overall server performance because the server cannot utilize hardware resources as needed. Also, sharing introduces a varying load which makes it impossible to predict future server performance.
  1. Provide a dedicated SQL server instance to the App Control
  2. Provide dedicated storage to App Control SQL storage files, not used by either other databases or other applications
Hardware Virtualization

Improperly virtualized server hardware or virtualizing the server for a large number of endpoints can impact the overall server performance. The impact can be on either the network, CPU, memory, or storage layer.
  1. Move product to physical hardware
  2. Move product to 1-tier virtual hardware
  3. Ensure that the virtual machine satisfies OER requirements (CPU, Memory), uses physical storage, and that there is very low latency between the App Control and SQL servers in case of 2-tier deployment

App Control Server: Communication Requirements

Requirement Details Additional Notes
Port 443 access Outbound SSL From App Control Server to App Control Cloud Services (CDC) Allow connection to services.bit9.com and reputation.threatintel.carbonblack.io (proxy connections are supported)
Inbound HTTPS from App Control Console users and App Control Agents (for software upgrades)
Inbound Port 41002 access Inbound SSL from App Control agents Port is configurable
Outbound Port 514 access Outbound UDP for Syslog/SIEM connections Optional, if Syslog/SIEM integrations are enabled. Port is configurable
Ethernet connection 1 GB/s connection required for connection to App Control Agents
Static IP address only (no DHCP) with an assigned FQDN or alias; IPv4 and/or IPv6 supported
AD Integration Server must be a member of a domain if AD integration is utilized
Bandwidth For every 1000 agents, you can expect server bandwidth to average about:

• Inbound: 200kb/s

• Outbound: 50kb/s

Server Release Life Cycle Status

Use the following table to determine the product life cycle stage of your VMware Carbon Black App Control Server software.

Versions not listed are in the status: End of Support.

See VMware Carbon Black App Control Support Policy for product life cycle information.

Table 6. Server Software in Status: Standard Support
Server Version GA Enter Standard Enter Extended Enter End of Support
8.10.x 27 July 2023 27 July 2023 27 July 2024 27 July 2025
8.9.x 10/2022 10/2022 4/2024 4/2026
Table 7. Server Software in Status: Extended Support
Server Version GA Enter Standard Enter Extended Enter End of Support
8.8.x 12/2021 12/2021 6/2023 6/2025
8.7.x 8/2021 8/2021 2/2023 2/2025
8.6.x 2/2021 2/2021 8/2022 8/2024
8.5.x 9/2020 9/2020 2/2022 2/2024