Unified Management of Rules

If you have multiple Carbon Black App Control Servers and have enabled Unified Management, you can centrally manage the following rule types.

• File Rules (bans and approvals)
• Custom Rules
• Registry Rules
• Memory Rules

Unified Management provides additional options for creating, distributing, and managing these rules. You can:

• distribute a new rule to multiple servers at the time you create it.
• copy one or more existing rules from the management server to one or more client servers.
• customize the rank of unified Custom, Registry, and Memory Rules on each server.
• specify whether administrators on client servers can modify unified rules.
• enable and disable unified rules on one or more servers.
• view all rules (unified or local) on unified servers through the management server.

With these options, you can decide how and when you distribute rules to your servers, and determine how much variation you want to allow after you distribute the rules. For example, you can send a rule to all servers immediately when you create it, or you might want to test a new rule on one server first and then copy it to the other servers after you are satisfied with it. You might want some rules to be uniform on all servers while allowing others to be modified.

Note: Exporting and importing rules is not the same as Unified Management; you can perform these actions between servers that are not part of a Unified Management group. See Exporting and Importing Rules.