Certain rules created on one Carbon Black App ControlServer may be exported to a file and then imported from the file to another Carbon Black App Control Server.

The following rule types are exportable:

  • Custom rules
  • Registry rules
  • Memory rules

Rule export and import can be useful in several different situations:

  • Transfer from Test to Production Environments - You may want to create, test and perfect rules in a lab environment before you apply them to your production server. With rule export and import, once you are satisfied with rule behavior, you can export rules from the test server and import the rule file to the production server, eliminating the effort and error potential of manual re-entry of the rule fields.
  • Rule Sharing in the Carbon Black Community - Users who have created a rule or set of rules they consider particularly useful can make their rule(s) available in a file that may be imported by other members of the community.
  • Solutions from Carbon Black Support - If you need assistance in creating a rule to accomplish a particular outcome and have not found an appropriate rule on the User Exchange, Carbon Black Support or Services may be able to provide an appropriate rule for you to import it to your server.

The location of the Export Rules and Import Rules buttons on the Custom tab of the Software Rules page

You export and import rules on the Software Rules page tab that shows the rule table for each of the exportable rule types. One or more rules of the same type may be included in an export file, but rule types are not mixed in the same file; for example, you cannot mix custom and registry rules in the same file.

Exported rule files are downloaded using the standard download mechanism and target location for the browser in which the console is displayed. They have the extension .rules. As new rules are created or existing rules changed, new export files may be generated as needed.

Rule files are encrypted to prevent tampering. When a file is exported, it can be further protected with an optional password.

Note:
  • Rules can be exported and imported only from and to Carbon Black App Control Servers at version 7.2.1 and later.
  • If you are using Unified Management, rules can be copied directly to managed client servers without using a file as an intermediary. For more information, see Unified Management of Rules.