The Add Notifier and Edit Notifier pages contain the settings you can modify to customize a notifier.

Table 1. Add/Edit Notifier Page Settings

Field

 

Copy Settings From

(For Add Notifier page only) Existing notifier from which to copy the initial settings for the new notifier. You can use this to populate all of the new notifiers fields and then modify only those you want to change. Choose (none) if you want to fill in all notifier fields from scratch.

Name

The notifier name as it will appear in the Notifiers table and menus on the policy and rule pages. This name does not appear on notifier displayed to the computer user.

Notifier Title

Window title for the notifier message that the computer user sees when the agent blocks file execution as a result of this setting.

Notifier Text

Explanatory message displayed in the notifier on Windows computers when the agent blocks file execution as a result of this setting. You can modify this message, tag different messages for block-only vs. block-and-prompt conditions, add tags that provide event-specific information, and add other conditional text. Tags here also can modify the Approval Request feature.

For description of a tag, see Editing Notifier Text. For a description of how to activate and configure Approval Requests, see Approval Requests and Justifications.

PLATFORM NOTE: Notifier text appears on the Prompt notifier for all platforms, on the Block-only notifier for Windows, and on the Carbon Black App Control Notifier history dialog for a selected item in the history. Notifier messages also appear in the Windows event log.

Notifier Logo

By default, the Carbon Black logo appears in the notifier dialog box when an App Control setting blocks a file. The Notifier logo menu gives you these options:

  • Leave Carbon Black Logo as the selection.
  • Choose None to display no logo or image in the notifier.
  • Choose Custom and provide a URL or file path to a different image. For details about image format and file path requirements, see Specify a Custom Notifier Logo.

PLATFORM NOTE: Custom logos are displayed on Windows agents only.

Notifier Link

Either:

  • a link to an informational web page where the computer user can learn more about your security settings and procedures for responding to blocked files, or
  • a mailto: link to allow the user to send questions by mail

The URL or mailto link provided here can appear literally in the notifier or be represented by a “Friendly Text” description.

Leave this field blank if you choose not to display a URL or mailto link at this time.

PLATFORM NOTE: For this release, Notifier Links appear only on Windows notifiers.

Notifier Timeout

The number of seconds that a block-only notifier stays on the screen on a Windows computer. After the specified period of time, the notifier is automatically closed.

The default timeout value is zero (0), which leaves the notifier on screen so that the user must respond to it. A value of negative one (-1) instructs agents not to display the notifier at all. For additional information about enabling and disabling blocked action notifiers, see Disabling App Control Notifiers.

This value does not affect prompt notifiers, which remain visible for 10 minutes and then automatically block the action if the user has not made a choice.

PLATFORM NOTE: This value affects Windows computers only. On Mac and Linux, a block-only notifier times out in 5 seconds by default.

Approval Request

Determines whether and how the Approval Request feature is enabled for this notifier. The choices are:

  • None - No approval request panel is displayed.
  • Approval Request - The Approval Request panel appears when a rule completely blocks access to a file.
  • Justification - The Justification panel appears when a rule prompts a user to allow or block an action.
  • Approval Request and Justification - The Approval Request/Justification panel appears for both block and prompt conditions.

For more detail, see Approval Requests and Justifications.

Notifier Applies to

(Appears only if the notifier is assigned to at least one setting or rule) This panel lists all of the rules and settings to which the notifier is assigned. You can remove all of these assignments by clicking Remove Associations in the Advanced menu. If you do this, the affected policy settings revert to their default notifier and the affected rules revert to the policy-specific notifier for their rule type.

Related Views on the Edit Notifier Page

Using the Related Views menu on the Edit Notifier page, you can get a list of all computers that have received the current version of the notifier, or a list of all computers that have not received the notifier.