You can locally approve transient or deleted files through the Action menu on the Events page or the Actions menu on the File Details page.
There can be cases in which a file appears briefly on a computer to accomplish a particular task. One example of this is a printer driver installation, during which a temporary file could appear long enough to install the driver and then disappear. Although this file does not appear in the Files on Computers page, you might want to locally approve it by hash so that installation of this driver is not blocked by Carbon Black App Control on a particular computer.
For files that are selected and approved by a local approval command, the local approval persists indefinitely. This means that even after all copies are deleted, new instances of the same file that appear on the computer in the future will be locally approved.
Other local approvals expire several days after all instances of a file are deleted from a computer. If a new instance of the same file appears on the same computer in the future, its state is recalculated. This time period depends on how the file was approved. Specifically:
- Approvals that are created by an automated method that can always be recalculated (such as a Publisher Rule or Reputation score) linger for 3 days by default.
- Approvals that are created by an automated method that cannot necessarily be recalculated (such as a Custom Rule or enforcement level change) linger for 14 days by default.
