When it analyzes a file, Carbon Black App Control determines whether the file is likely to be an installer – that is, whether it will generate additional files when it executes.

By locally approving a file that is identified as an installer, you make any files it installs locally approved as well. Files not identified as installers do not transfer their approval status to files they generate, if any.

A file can be mis-categorized, or you prefer not to have the local approval of a top-level file impact local approval status of the files it installs. You can override installer status using menus on the file details pages.

Note: No Linux files are recognized as installers. The only macOS files recognized as installers are packages – that is, files with .PKG extensions and properly defined archive headers. Because of this, using the Mark as installer feature can be particularly useful for these platforms.

To mark a file as an installer, on the File Details or File Instance Details page, click Mark as Installer in the Actions menu.

To mark a file as not an installer, on the File Details or File Instance Details page, click Mark as Not Installer in the Actions menu.

Note:
  • When you override the installer status of a file, that override is shown in the Local State Details for the file.
  • In file tables, if you select the check box next to a file not identified as an installer and you select Approve by Policy on the Action menu, you can mark the file as an installer as part of your approval rule. This ensures that new files it writes are locally approved. Files it has already written remain in their current state.
  • You can create a Custom Rule that promotes files meeting the rule specifications. This treats these files as installers under the conditions of the rule, but does not change their global status as an installer or not an installer. See Custom Software Rules.