There might be situations in which you want to disable notifiers for some or all of your agent computers.

For example, if you are running single-purpose devices in High Enforcement, you might simply want to block unauthorized actions without feedback. Block-only notifiers can be disabled without disabling the rules that can otherwise display them. You can disable notifiers on a per-setting basis in each policy. You also can disable notifiers for specific custom, memory, or registry rules.

You can disable notifiers only for block-only rules. Rules that prompt users for a response should always display a notifier.

Disabling Carbon Black App Control notifiers does not necessarily mean that actions are blocked silently. Some Carbon Black App Control blocks cause the display of operating system notifiers. Also, except for a Custom, Registry, or Memory rule that has Block Silently as its action, events continue to be recorded for blocks even though the notifier is disabled.

Disable Policy Notifiers

You can disable one or more notifications for the settings in a policy.

Procedure

  1. On the console menu, navigate to the Rules > Policies page.
  2. Click View Details next to the policy you want to edit.
  3. On the Edit Policy page, click the tab on which you want to disable notifiers.
    For example, if you want to disable an Advanced Setting notifier, click Advanced.
  4. For each setting on that tab whose notifier you want to disable, select <none> from the Notifiers drop-down menu.
  5. Consider all conditions for a setting before changing its notifier to <none>.
    For example, if you select <none> for Block unapproved executables, users in Medium Enforcement policies, who must be able to choose whether to block or allow execution of unapproved files, might not have the opportunity to make that decision. The file is blocked without any notice from Carbon Black App Control.
  6. To preserve your changes on this tab and select another tab for disabling additional notifiers, click Save.
  7. Repeat steps 2-4 for each tab on which you want to disable notifiers in this policy.
  8. When you have finished disabling notifiers for this policy, click Save & Exit.
  9. Repeat this procedure for each policy whose notifiers you want to change.

Disable Notification for a Rule

You can disable one or more notifications for the settings in a specific Custom, Registry, or Memory rule.

For Block actions, events are still recorded even if the notifier is disabled. For some rules, you can select Block Silently from the action menu to disable both notifiers and event recording.
Note: You can also disable a notifier everywhere it appears (rather than choosing not to use a notifier for a setting). You do this by entering minus one ( -1) as the value for Notifier Timeout on the Add/Edit Notifier page.

Procedure

  1. On the console menu, navigate to the Rules > Software Rules page.
  2. On the Software Rules page, click the tab for the rule type you want to modify.
  3. Click the View Details button next to the rule whose notifier you want to disable.
  4. On the Edit Rule page, uncheck the Use Policy Specific Notifier box next to any actions configured in the rule.
  5. From the Custom Notifier drop-down menu, select <none>.
    Note: <none> is not an option for rules that prompt the user.
  6. To preserve your changes, click Save.