Carbon Black App Control provides a mechanism for automatic periodic updates to Indicator Sets.
Updates can involve entirely new Indicator Sets, new indicators added to existing sets, reorganization of Indicator Sets, or changes to existing indicators. These changes are delivered automatically when available if both of the following are true:
- You have enabled Carbon Black File Reputation.See Activating Carbon Black File Reputation.
- You have enabled automatic Indicator Set updates on the System Confirmation / Advanced Options page. See Advanced Configuration Options.
You can leave automatic updates enabled all the time or temporarily enable updates periodically. Updates are scheduled to be delivered within 24 hours and often appear sooner than that.
If you receive automatic updates, the state of Indicator Sets is as follows:
- New Indicator Sets are added in a disabled state.
- Existing Indicator Sets remain enabled or disabled according to the state they were in prior to updating. This is true even if the upgrade adds or modifies threat indicators in the existing Indicator Set.
