The Carbon Black App Control Server maintains a central database of unique files (determined by hash) for all executable files tracked on computers running the Carbon Black App Control Agent.
You can view the global state of these files in the File Catalog. Global state determines what the file is allowed to do on agent-managed computers with different Enforcement Levels.
Global state is a combination of:
- File State, which indicates the approval/ban state of the file itself, and
- Publisher State, which is the approval state of the file’s publisher (if known).
A file can have a global state of:
- Approved – for all computers
- Approved by Policy – approved for some computers, unapproved for others
- Banned – for all computers
- Banned by Policy – banned for some computers, unapproved for others
- Unapproved – for all computers
- Mixed – banned for some computers but approved for others
Global State cannot be modified directly, but can be modified by changing the file state or publisher state. Carbon Black App Control provides a variety of ways to modify the file state. See Approving and Banning Software for details. File, Publisher, and Application Information shows additional details for files tracked by Carbon Black App Control.
