The Publishers tab on the Software Rules page shows file publishers discovered on computers running the Carbon Black App Control Agent in your organization. It also shows any publishers that have been manually added to the File Catalog for your Carbon Black App Control Server.

This page includes an Action menu that allows you to approve or ban a publisher, remove approvals or bans, and acknowledge a publisher to indicate that you have reviewed it already. These actions are described in Approving or Banning by Publisher.

View the List of Publishers

To view the list of publishers, perform the following procedure.

Procedure

  1. On the console menu, click Rules > Software Rules.
  2. Click the Publishers tab. All publishers of signed software installed on agent-managed computers reporting to your server, plus any publishers you manually added using certificates, appear in the Publishers table:
    The Publishers tab on the Software Rules page

View Complete Details for one Publisher

To view complete details for one publisher, perform the following procedure.

You can view a Publisher Details page for any publisher shown in the Publishers table by clicking the View Details button next to the publisher name. In addition to details, the Publisher Details page has shortcuts with which you can Approve or Remove Approval for the publisher. The Related Views menu also includes a command that shows all files from the publisher in addition to commands that show computers where the approval state for this publisher is up-to-date.

Procedure

  1. On the console menu, click Rules > Software Rules.
  2. Click the Publishers tab.
  3. From the table of publishers, locate the publisher to authorize and click the View Details button.
    The Publisher details for the selected publisher

Publisher Details

This section describes Publisher details that you can find on the Publisher Details page.

Field

Description
General panel

Publisher Name

(in Details)

Name

(in Table)

The name of this publisher as it appears in its certificate.

State

Approved, Unapproved, or Banned.

Enable reputation approvals...

(in Details)

Reputation Enabled

(in Table)

This check box displays if you have reputation approvals enabled. Enable reputation approvals for this publisher is selected by default and allows this publisher to be approved by reputation. Deselecting the check box disables reputation approvals for this publisher, but if reputation approvals were already globally enabled, removal only affects files first seen after the change.

Acknowledged

You can Acknowledge a publisher, which indicates that you have reviewed it.

Trust

This field displays if you have Carbon Black File Reputation enabled. Shows the trust rating for this publisher, which can be High, Medium, Low, or Not Trusted.

Description

Optional additional description of this publisher and its state.

Rule Applies To

(in Details)

Policy

(in Table)

For publishers that do not have reputation approval enabled, you can apply the publisher state to computers in all policies, or only to those in some policies.

Platforms

(in Details)

Approved Platforms

(in Table)

You can apply the publisher state to computers in all platforms or choose a specific platform).

Publisher approvals work on Windows only.

All Certificates For This Publisher panel 

The Publisher Details page includes a panel entitled All Certificates for This Publisher. Because this panel has the potential to be long, it can be collapsed and expanded on the page by clicking the panel name. The panel shows all leaf certificates for this publisher, and all root and intermediate certificates associated with these leaf certificates. See Managing File-Signing Certificates for more on certificate details.

History panel

Date First Seen

(in Details)

First Seen Date

(in Table)

When this publisher was first seen on a agent-managed computer reporting to your server.

Platform First Seen

(in Details)

First Seen Platform

(in Table)

The platform of the computer on which this publisher was first reported to your server.

Computer First Seen

(in Details)

First Seen Computer

(in Table)

The computer on which this publisher was first reported to your server.

Date Approved

If the publisher is approved, the data when that approval was made.

Approved By

Banned By

The console user who approved or banned the publisher. Publishers approved by reputation may show System in this field.

Date Acknowledged

If the publisher has been acknowledged, when it was acknowledged.

Acknowledged by

If the publisher has been acknowledged, the console user that acknowledged this publisher.

CL Version

The version of Carbon Black App Control rules containing current publisher state. This helps determine whether an agent has the rule.