This table lists all Policy Enforcement events and their unique subtypes specific to this release of App Control.
| Subtype | ID No. | Severity | Example Descriptions/Comments | |
|---|---|---|---|---|
| Access block (Memory Rule) | 830 | Notice | Access to process '$filePathAndName$' was restricted - Requested[$param1$] Restricted[$param2$]. |
|
| Access prompt (Memory Rule) | 831 | Info | Access to process '$filePathAndName$' was granted because of a Memory Rule user response. Access to process '$filePathAndName$' was restricted because of a Memory Rule user response. |
|
| Banned process discovered | 847 | Warning | The Carbon Black App Control Agent discovered a banned process '$filePathAndName$' [$hash$] that ran during system startup. $param1$ |
|
| Carbon Black EDR Watchlist | 842 | Notice | If Process watchlist and file are known to App Control: Carbon Black EDR process watchlist '$ruleName$' hit for process '$process$' [$hash$] on computer '$computer$'. Carbon Black EDR watchlist '$watchlist$' detected file '$filePathAndName$' [$hash$] on computer '$computer$'. If Process watchlist and file are unknown to App Control: Carbon Black EDR process watchlist '$ruleName$' hit for unknown process '$process$' [$processhash$] on computer '$computer$'. Carbon Black EDR watchlist '$watchlist$' detected unknown file '$filePathAndName$' [$hash$] on computer '$computer$'. (continued on next page) (continued from previous page) If Binary watchlist and file are known to App Control: Carbon Black EDR binary watchlist '$ruleName$' detected file '$filePathAndName$' [$hash$]. If Binary watchlist and file is unknown to App Control: Carbon Black EDR binary watchlist '$ruleName$' detected unknown file '$filePathAndName$' [$hash$]. |
|
| Execution allowed (file loaded before kernel) | 843 | Warning | The $param1$ file '$filePathAndName$' [$hash$] executed before the Carbon Black App Control Agent was running. $param2$ |
|
| Execution allowed (file loaded before service) | 844 | Warning | The $param1$ file '$filePathAndName$' [$hash$] executed before the Carbon Black App Control Agent was enforcing. $param2$ |
|
| Execution allowed (inactive) | 841 | Warning | Execution of file '$filePathAndName$' [$hash$] would have blocked if Carbon Black App Control Agent was active. |
|
| Execution allowed (Trusted User) | 815 | Notice | Execution of unapproved file '$filePathAndName$' [$hash$] was allowed because of a Trusted User '$username$'. |
|
| Execution allowed (Unanalyzed file loaded before service) | 846 | Warning | The file '$filePathAndName$' executed before the Carbon Black App Control Agent started. The file was removed before the Carbon Black App Control Agent could analyze it. $param2$ |
|
| Execution block (banned file) | 802 | Notice | File '$filePathAndName$' [$hash$] was blocked because it was banned. | |
| Execution block (Custom Rule) | 806 | Notice | File '$filePathAndName$' with hash [$hash$] was blocked because of a Custom Rule. Process '$process$' was terminated due to a Custom Rule. |
|
| Execution block (network file) | 805 | Notice | The file '$filePathAndName$' [$hash$] was blocked because it was located on a remote drive. | |
| Execution block (prompt timeout) | 839 | Info | File '$filePathAndName$' with hash [$hash$] was blocked because of a timeout waiting for user response. | |
| Execution block (removable media) | 819 | Notice | File '$filePathAndName$' with hash [$hash$] was blocked from execution because it was on removable media. | |
| Execution block (still analyzing) | 804 | Info | File '$filePathAndName$' was blocked because Carbon Black App Control Agent did not have time to analyze it. |
|
| Execution block (unapproved file) | 801 | Notice | File '$filePathAndName$' [$hash$] was blocked because it was unapproved. | |
| Execution prompt (Custom Rule) | 818 | Info | File '$filePathAndName$' [$hash$] was executed because of a Custom Rule user response. |
|
| Execution prompt (unapproved file) | 814 | Info | File '$filePathAndName$' [$hash$] was approved because of a user response. | |
| Execution prompt allowed (unapproved file) | 838 | Info | File '$filePathAndName$' [$hash$] was approved because of a user response. | |
| Execution prompt block (unapproved file) | 837 | Info | File '$filePathAndName$' [$hash$] was blocked because of a user response. | |
| File access error | 825 | Warning | Unable to access the file '$filePathAndName$'. | |
| File approved (cache consistency) | 835 | Info | File '$filePathAndName$' [$hash$] was approved due to cache a consistency scan. | |
| File approved (Custom Rule) | 833 | Info | File '$filePathAndName$' [$hash$] was approved due to Custom Rule. |
|
| File approved (local approval) | 813 | Info | File '$filePathAndName$' [$hash$] was locally approved. | |
| File approved (publisher) | 812 | Info | File '$filePathAndName$' [$hash$] was approved by Publisher '$publisherName$'. | |
| File approved (Reputation) | 840 | Info | File '$filePathAndName$' [$hash$] was approved by reputation. Note: This event occurs when an agent attempts to run an unapproved file, checks with the server, and is given a reputation approval from the server that was not previously sent to the agent. |
|
| File approved (system update) | 836 | Info | File '$filePathAndName$' with hash [$hash$] was approved due to system update. Note: For Windows, this applies to the package/root files from Windows Update, not files installed from them. |
|
| File approved (Trusted User) | 810 | Info | File '$filePathAndName$' [$hash$] was approved by Trusted User '$username$'. |
|
| File approved (Unidesk) | 850 | Info | The file '$filePathAndName$' [$hash$] was approved due to Unidesk read-only provisioning. '$param1$' '$param2$' | |
| File approved (updater) | 811 | Info | File '$filePathAndName$' [$hash$] was approved by an Updater. | |
| File approved (version resource) | 834 | Info | File '$filePathAndName$' [$hash$] was approved due to version resource. | |
| File approved (Yara) | 852 | Info | The file '$filePathAndName$' [$hash$] was approved due to yara rule(s). '$param1$' '$param2$' | |
| Metered execution | 816 | Notice | Metered file '$filePathAndName$' [$hash$] was executed by the user '$username$'. | |
| New file discovered on startup | 845 | Warning | The newly discovered file '$filePathAndName$' [$hash$] was executing when the Carbon Black App Control Agent started. $param1$ |
|
| Prompt canceled | 849 | Warning | Prompt '$filePathAndName$' [$hash$] prompt is canceled ($param1$). Note: Param1 shows the reason a notifier prompt was cancelled. It can be one of the following:
Platform Note: This event only occurs for Mac OS X and Linux agents. |
|
| Read block (Custom Rule) | 854 | Notice | Read of file '$pathname$$pathSeparator$$filename$' was blocked because of a Custom Rule. | |
| Read block (removable media) | 821 | Notice | Read access to file '$filePathAndName$' with hash [$hash$] was blocked because it was on removable media. | |
| Report access (Memory Rule) | 829 | Info | Access to process '$filePathAndName$' was granted – Requested[$param1$] Note: Param1 is a hex number indicating the Windows code of the permissions requested. |
|
| Report execution (Custom Rule) | 807 | Notice | File '$filePathAndName$' [$hash$] was executed. Process '$process$' failed to be terminated: $param3$. Banned image: '$filePathAndName$' [$hash$]. Process '$process$' would have been terminated due to the banned file '$filePathAndName$' [$hash$] if Policy were not in Visibility Only Process '$process$' would have been terminated due to the banned image '$filePathAndName$' [$hash$]: $param3$.". |
|
| Report execution (removable media) | 822 | Info | File '$filePathAndName$' with hash [$hash$] was executed on removable media. | |
| Report execution block | 803 | Notice | File '$filePathAndName$' [$hash$] would have blocked if a ban were not in Report Only mode. | |
| Report read (Custom Rule) | 855 | Info | File '$pathname$$pathSeparator$$filename$' was read. | |
| Report read (removable media) | 824 | Info | File '$filePathAndName$' was read on removable media. | |
| Report write (Custom Rule) | 809 | Info | File '$filePathAndName$' was modified or deleted. |
|
| Report write (Registry Rule) | 826 | Info | Modification of registry '$filePathAndName$' was allowed. |
|
| Report write (removable media) | 823 | Info | File '$filePathAndName$' was modified or deleted on removable media. | |
| Tamper Protection | 832 | Warning | Execution of '$filePathAndName$' by '$username$' was blocked because tamper protection was enabled. Modification of '$filePathAndName$' by '$username$' was blocked because tamper protection was enabled. Execution of '$filePathAndName$' by '$username$' would have been blocked if tamper protection were enabled. Modification of '$filePathAndName$' by '$username$' would have been blocked if tamper protection were enabled. |
|
| Unapproved process discovered | 848 | Warning | The Carbon Black App Control Agent discovered an unapproved process '$filePathandName$' [$hash$] that ran during system startup. $param1$ |
|
| User Login denied | 853 | Warning | User '$param1$' prohibited from logging in on computer $computer$. | |
| Write block (Custom Rule) | 808 | Notice | Modification of file '$filePathAndName$' [$hash$] was blocked because of a Custom Rule. |
|
| Write block (Registry Rule) | 827 | Notice | Modification of registry '$filePathAndName$' was blocked. |
|
| Write block (removable media) | 820 | Notice | Modification of file '$filePathAndName$' with hash [$hash$] was blocked because it was on removable media. | |
| Write prompt (Custom Rule) | 817 | Info | File '$filePathAndName$' was modified or deleted because of a Custom Rule user response. Modification of file '$filePathAndName$' [$hash$] was blocked because of a Custom Rule user response. |
|
| Write prompt (Registry Rule) | 828 | Info | Registry '$filePathAndName$' was modified or deleted because of a Registry Rule user response. Modification of registry '$filePathAndName$' was blocked because of a Registry Rule user response. |
