The ExApprovalRequests view provides access to the work flow for approval requests created by users through the Carbon Black App Control notifier when attempts to execute a file are blocked.
This includes approval requests for files that are completely blocked from running and justifications for cases when the user responded to a prompt by allowing a file to run.
Field Name |
Data Type |
Special Values |
Comments |
---|---|---|---|
|
Int |
|
Primary Key |
|
Int |
|
Foreign key into ExFileCatalog table for file for which approval request was created |
|
Int |
|
Foreign key into ExFileCatalog table for process associated with file for which approval request was created |
|
Int |
|
Foreign key into ExFileCatalog table for root file associated with file for which approval request was created |
|
Int |
|
Foreign key into ExComputers table for computer on which approval was requested |
|
datetime |
|
Date and time (UTC) when this approval request was created |
|
datetime |
|
Date and time (UTC) when this approval request was last modified |
|
nvarchar |
|
User that last modified this approval request |
|
nvarchar |
Valid enforcement levels |
Enforcement Level of agent when file was blocked |
|
nvarchar |
Not Resolved Resolved - Publisher Resolved - Installer Resolved - Approved Resolved - Rule Change Resolved - Other Rejected |
Resolution of request |
|
nvarchar |
Approval Justification |
Type of approval request: Approval if file was blocked; Justification if file triggered a user-choice prompt |
|
nvarchar |
|
User that created approval request on the agent |
|
nvarchar |
|
Comments provided during approval request creation |
|
nvarchar |
|
Email address provided during approval request creation |
|
nvarchar |
High, Low, Medium |
Priority assigned to this request by the user creating it |
|
nvarchar |
|
Comments provided during resolution of request |
|
nvarchar |
New, Closed |
Current status of the request |
|
nvarchar |
|
Name of the Policy where agent was in when block happened |
|
nvarchar |
Yes, No |
Whether multiple blocks happened on this endpoint and hash |
|
nvarchar |
|
Name of the file that was blocked on the agent |
|
nvarchar |
|
Path of the file that was blocked on the agent |
|
nvarchar |
|
Full path to the process that wrote the file that was blocked on the agent |