Several locations in the Carbon Black App Control Console provide access to commands for manually uploading files.
- Events page (for events showing files that exist on computers)
- Approval Requests page
- File Catalog and Files on Computers tables
- Find File Results table
- Snapshot Contents table
- File Details and File Instance Details pages
- Computer Details page (for uploading a file by path only)
From most of these pages, you can upload a copy of any file that has been identified as "interesting" (that is, executable) by Carbon Black App Control and has been added to the live inventory. From the Computer Details page, you can upload a copy of any file on the computer, whether or not it exists in your file inventory. For all uploads, the original file remains on the agent computer. Note that there are separate permissions for uploading files from the inventory and uploading any file by path.
In addition to performing manual uploads, you can create Event Rules that upload files when certain events take place. See Event Rules for more information.
When you issue a successful upload command, a message appears on the console page indicating that the upload has been scheduled. In general, uploads begin almost immediately, but there could be delays depending upon other activities on the Carbon Black App Control Server and the size of the file you are uploading. Also, the Carbon Black App Control Server needs at least read permission to upload the file, and some files that are currently opened by other programs cannot be uploaded. If the Carbon Black App Control Server does not have read permission for a requested file on any agent-managed computer, the Uploaded Files table shows an error message for that file.
If an upload is scheduled for a file and no computer with that file is currently connected, the upload will be attempted later. If a file upload is interrupted because of an agent-side error, it will be retried.
