When a file action is blocked without an option to allow it, if Approval Requests are enabled, the user can request approval of the file. The location for entering this request varies depending upon the platform.
On Windows computers, Approval Request are submitted through the block notifier. The users can read the notifier’s description of the block and why it happened. If the user still wants access to the file or device that was blocked, he or she can type an Approval Request of up to 512 characters into the Approval Request box in the bottom-left section of the notifier. The user can enter an email address if they want that included in the request, and can set a priority (Medium by default). Once the text of the approval is entered, the Submit button is activated and clicking it submits the request to the Carbon Black App Control Server.
On the Windows notifier, the Submit button, not the Submit Approval Request link, sends the request. The Submit Approval Request link opens and closes the Approval Request panel at the bottom of the notifier.
Submitting a request from a block-only notifier closes the notifier – it is not necessary to click OK in this case.
On Mac and Linux computers, when an action is completely blocked, users can make approval requests from the App Control Notifier history window by selecting any block event from the history and entering the information as described above for Windows (limited to 512 characters). Unlike in Windows, Mac and Linux users can make a series of requests for different file approvals without closing the Carbon Black App Control Notifier history.
On all platforms, if a notifier prompts the user to Allow or Block a file action, the user can submit a Justification for choosing Allow. The interface is the same as for an Approval Request. After submitting the justification, the user must click either the Block button or one of the buttons that let the action happen (Allow or Promote).
Once a user submits a request or justification, there is no formal connection to the request from the agent. However, the user can send another request for the same file or device, and can change the comments or the priority (for example, if lack of access to a file is preventing them from accomplishing a task) in the resubmission. Response to the request, or lack of one, is at the discretion of Carbon Black App Control administrator reviewing it.
