This section describes the location and contents of file information in Carbon Black App Control. It also includes:

  • information about the publishers associated with these files
  • information Carbon Black App Control collects about applications
  • how to exclude tracking of certain files
  • how to show all computers with or without certain files

File information from multiple Carbon Black App Control Servers can be viewed through a central management server. See Unified Management of Multiple Servers.

Carbon Black App Control collects different kinds of data about the interesting files it discovers on your computers. Interesting files are files that are either determined by Carbon Black App Control to be executable (for example, .EXE or .DLL files), or files that match file extensions defined as scripts. You can use this information to be aware of file activity, or to make decisions about controlling execution and writing of particular files or classes of files.

Many files discovered by the Carbon Black App Control Agent have an identified publisher. A publisher name can be useful to know where a file came from, or this information can be used to automatically approve or ban files.

Note:

Some file and publisher information is provided by the Carbon Black File Reputation. You must have Carbon Black File Reputation integration activated to receive this information. See Activating Carbon Black File Reputation for more information.

For information about using file and publisher information to approve or ban files, see Approving and Banning Software.

File information is presented in table form in several places in the console, but the primary starting point is the Files page, which you access by clicking Assets > Files on the console menu. The Files page has two tabs:

  • The File Catalog tab shows the unique interesting files discovered on your computers. Cataloged files include those currently present and tracked on the fixed, local drives of agent computers, files considered interesting but not tracked in inventory, and files that were present on an agent system but have been deleted.
  • The Files on Computers tab shows tracked file instances. This includes every instance of every interesting file on the fixed, local drives of every agent-managed computer reporting to your Carbon Black App Control Server (once their files are fully processed), with these possible exceptions:
    • You can exclude common Microsoft operating system and application support files from the file inventory to reduce tracking overhead and database size. See Excluding Tracking of Microsoft Support Files.
    • You can exclude instances of files that are in the template used by a VDI product to create a clone. See Configuring Clone Inventory.
    • You can disable file tracking on a policy-by-policy basis.

If any of these conditions affects files on your computers, the Prevalence value for those files will not be accurate – only tracked file instances contribute to Prevalence.

For complete information about one file in a table, you can go to a details page for the file:

  • The File Details page shows the global information about one unique file and provides a link to a list of all instances of that file.
  • The File Instance Details page shows information about a specific file instance on a specific computer.

The table of publishers for files discovered on agents is shown on the Publishers tab of the Software Rules page. For complete information about one publisher in the table, you can go to the details page for the publisher.

Carbon Black App Control agents collect information about Windows applications that are installed on agent systems and displays the information on the Applications page. The Applications page includes an Application Catalog tab, which shows each unique application on agent systems reporting to this Carbon Black App Control Server, and an Applications on Computers tab, which shows each instance of each application on each computer.

Most data about an application is from the metadata of the installer file for the application or the application’s registry data. It is similar to the information on the Programs and Features page of the Windows Control Panel.

See also Application Information.