The ExApprovalRequests view provides access to the work flow for approval requests created by users through the Carbon Black App Control notifier when attempts to execute a file are blocked.

This includes approval requests for files that are completely blocked from running and justifications for cases when the user responded to a prompt by allowing a file to run.

Table 1. ExApprovalRequests

Field Name

Data Type

Special Values

Comments

Approval_Request_Id

Int

 

Primary Key

File_Catalog_Id

Int

 

Foreign key into ExFileCatalog table for file for which approval request was created

Process_File_Catalog_Id

Int

 

Foreign key into ExFileCatalog table for process associated with file for which approval request was created

Root_File_Catalog_Id

Int

 

Foreign key into ExFileCatalog table for root file associated with file for which approval request was created

Computer_Id

Int

 

Foreign key into ExComputers table for computer on which approval was requested

Date_Created

datetime

 

Date and time (UTC) when this approval request was created

Date_Modified

datetime

 

Date and time (UTC) when this approval request was last modified

Last_Modified_By

nvarchar

 

User that last modified this approval request

Enforcement_Level

nvarchar

Valid enforcement levels

Enforcement Level of agent when file was blocked

Resolution

nvarchar

Not Resolved

Resolved - Publisher

Resolved - Installer

Resolved - Approved

Resolved - Rule Change

Resolved - Other

Rejected

Resolution of request

Request_Type

nvarchar

Approval

Justification

Type of approval request: Approval if file was blocked; Justification if file triggered a user-choice prompt

Requestor

nvarchar

 

User that created approval request on the agent

Requestor_Comments

nvarchar

 

Comments provided during approval request creation

Requestor_Email

nvarchar

 

Email address provided during approval request creation

Priority_Text

nvarchar

High, Low, Medium

Priority assigned to this request by the user creating it

Resolution_Comments

nvarchar

 

Comments provided during resolution of request

Status

nvarchar

New, Closed

Current status of the request

Policy

nvarchar

 

Name of the Policy where agent was in when block happened

Multiple_Blocks

nvarchar

Yes, No

Whether multiple blocks happened on this endpoint and hash

File_Name

nvarchar

 

Name of the file that was blocked on the agent

Path_Name

nvarchar

 

Path of the file that was blocked on the agent

Process

nvarchar

 

Full path to the process that wrote the file that was blocked on the agent