This table lists all Policy Enforcement events and their unique subtypes specific to this release of App Control.

Note: New or changed events are identified with ** (double-asterisk) in the left column. This allows a search to quickly identify only the new or changed events.
Table 1. Policy Enforcement Events and Subtypes
Subtype ID No. Severity Example Descriptions/Comments
Access block (Memory Rule) 830 Notice

Access to process '$filePathAndName$' was restricted - Requested[$param1$] Restricted[$param2$].

Access prompt (Memory Rule) 831 Info

Access to process '$filePathAndName$' was granted because of a Memory Rule user response. Access to process '$filePathAndName$' was restricted because of a Memory Rule user response.

Banned process discovered 847 Warning

The Carbon Black App Control Agent discovered a banned process '$filePathAndName$' [$hash$] that ran during system startup. $param1$

Carbon Black EDR Watchlist 842 Notice

If Process watchlist and file are known to App Control: Carbon Black EDR process watchlist '$ruleName$' hit for process '$process$' [$hash$] on computer '$computer$'.

Carbon Black EDR watchlist '$watchlist$' detected file '$filePathAndName$' [$hash$] on computer '$computer$'.

If Process watchlist and file are unknown to App Control:

Carbon Black EDR process watchlist '$ruleName$' hit for unknown process '$process$' [$processhash$] on computer '$computer$'.

Carbon Black EDR watchlist '$watchlist$' detected unknown file '$filePathAndName$' [$hash$] on computer '$computer$'.

(continued on next page)

(continued from previous page)

If Binary watchlist and file are known to App Control:

Carbon Black EDR binary watchlist '$ruleName$' detected file '$filePathAndName$' [$hash$].

If Binary watchlist and file is unknown to App Control:

Carbon Black EDR binary watchlist '$ruleName$' detected unknown file '$filePathAndName$' [$hash$].

Execution allowed (file loaded before kernel) 843 Warning

The $param1$ file '$filePathAndName$' [$hash$] executed before the Carbon Black App Control Agent was running. $param2$

Execution allowed (file loaded before service) 844 Warning

The $param1$ file '$filePathAndName$' [$hash$] executed before the Carbon Black App Control Agent was enforcing. $param2$

Execution allowed (inactive) 841 Warning

Execution of file '$filePathAndName$' [$hash$] would have blocked if Carbon Black App Control Agent was active.

Execution allowed (Trusted User) 815 Notice

Execution of unapproved file '$filePathAndName$' [$hash$] was allowed because of a Trusted User '$username$'.

Execution allowed (Unanalyzed file loaded before service) 846 Warning

The file '$filePathAndName$' executed before the Carbon Black App Control Agent started. The file was removed before the Carbon Black App Control Agent could analyze it. $param2$

Execution block (banned file) 802 Notice File '$filePathAndName$' [$hash$] was blocked because it was banned.
Execution block (Custom Rule) 806 Notice

File '$filePathAndName$' with hash [$hash$] was blocked because of a Custom Rule.

Process '$process$' was terminated due to a Custom Rule.

Execution block (network file) 805 Notice The file '$filePathAndName$' [$hash$] was blocked because it was located on a remote drive.
Execution block (prompt timeout) 839 Info File '$filePathAndName$' with hash [$hash$] was blocked because of a timeout waiting for user response.
Execution block (removable media) 819 Notice File '$filePathAndName$' with hash [$hash$] was blocked from execution because it was on removable media.
Execution block (still analyzing) 804 Info

File '$filePathAndName$' was blocked because Carbon Black App Control Agent did not have time to analyze it.

Execution block (unapproved file) 801 Notice File '$filePathAndName$' [$hash$] was blocked because it was unapproved.
Execution prompt (Custom Rule) 818 Info

File '$filePathAndName$' [$hash$] was executed because of a Custom Rule user response.

Execution prompt (unapproved file) 814 Info File '$filePathAndName$' [$hash$] was approved because of a user response.
Execution prompt allowed (unapproved file) 838 Info File '$filePathAndName$' [$hash$] was approved because of a user response.
Execution prompt block (unapproved file) 837 Info File '$filePathAndName$' [$hash$] was blocked because of a user response.
File access error 825 Warning Unable to access the file '$filePathAndName$'.
File approved (cache consistency) 835 Info File '$filePathAndName$' [$hash$] was approved due to cache a consistency scan.
File approved (Custom Rule) 833 Info

File '$filePathAndName$' [$hash$] was approved due to Custom Rule.

File approved (local approval) 813 Info File '$filePathAndName$' [$hash$] was locally approved.
File approved (publisher) 812 Info File '$filePathAndName$' [$hash$] was approved by Publisher '$publisherName$'.
File approved (Reputation) 840 Info

File '$filePathAndName$' [$hash$] was approved by reputation.

Note: This event occurs when an agent attempts to run an unapproved file, checks with the server, and is given a reputation approval from the server that was not previously sent to the agent.

File approved (system update) 836 Info

File '$filePathAndName$' with hash [$hash$] was approved due to system update.

Note: For Windows, this applies to the package/root files from Windows Update, not files installed from them.

File approved (Trusted User) 810 Info

File '$filePathAndName$' [$hash$] was approved by Trusted User '$username$'.

File approved (Unidesk) 850 Info The file '$filePathAndName$' [$hash$] was approved due to Unidesk read-only provisioning. '$param1$' '$param2$'
File approved (updater) 811 Info File '$filePathAndName$' [$hash$] was approved by an Updater.
File approved (version resource) 834 Info File '$filePathAndName$' [$hash$] was approved due to version resource.
File approved (Yara) 852 Info The file '$filePathAndName$' [$hash$] was approved due to yara rule(s). '$param1$' '$param2$'
Metered execution 816 Notice Metered file '$filePathAndName$' [$hash$] was executed by the user '$username$'.
New file discovered on startup 845 Warning

The newly discovered file '$filePathAndName$' [$hash$] was executing when the Carbon Black App Control Agent started. $param1$

Prompt canceled 849 Warning

Prompt '$filePathAndName$' [$hash$] prompt is canceled ($param1$).

Note: Param1 shows the reason a notifier prompt was cancelled. It can be one of the following:

  • EnforcementChange – Agent changed enforcement levels and the prompt no longer applies (e.g., moved from Medium to High, so the file will now just block).
  • SubsequentBlock – Agent blocked the file and is no longer waiting for response (typically means timeout or file was banned or had a rule change the blocked it).
  • AgentShutdown – System or daemon shutdown while the prompt was still outstanding. File will be blocked in this case.
  • PingTimeout – Agent was unable to communicate with notifier and canceled the prompt. This is an error case and should be rare.

Platform Note: This event only occurs for Mac OS X and Linux agents.

Read block (Custom Rule) 854 Notice Read of file '$pathname$$pathSeparator$$filename$' was blocked because of a Custom Rule.
Read block (removable media) 821 Notice Read access to file '$filePathAndName$' with hash [$hash$] was blocked because it was on removable media.
Report access (Memory Rule) 829 Info

Access to process '$filePathAndName$' was granted – Requested[$param1$]

Note: Param1 is a hex number indicating the Windows code of the permissions requested.

Report execution (Custom Rule) 807 Notice

File '$filePathAndName$' [$hash$] was executed.

Process '$process$' failed to be terminated: $param3$. Banned image: '$filePathAndName$' [$hash$].

Process '$process$' would have been terminated due to the banned file '$filePathAndName$' [$hash$] if Policy were not in Visibility Only

Process '$process$' would have been terminated due to the banned image '$filePathAndName$' [$hash$]: $param3$.".

Report execution (removable media) 822 Info File '$filePathAndName$' with hash [$hash$] was executed on removable media.
Report execution block 803 Notice File '$filePathAndName$' [$hash$] would have blocked if a ban were not in Report Only mode.
Report read (Custom Rule) 855 Info File '$pathname$$pathSeparator$$filename$' was read.
Report read (removable media) 824 Info File '$filePathAndName$' was read on removable media.
Report write (Custom Rule) 809 Info

File '$filePathAndName$' was modified or deleted.

Report write (Registry Rule) 826 Info

Modification of registry '$filePathAndName$' was allowed.

Report write (removable media) 823 Info File '$filePathAndName$' was modified or deleted on removable media.
** Rule data too large 5400 Error The rule '$ruleName$' is too large to send to agents. THE CHANGES TO THE RULE ARE NOT IN EFFECT. Most likely this is due to a parameter containing a large number of entries. Please reduce the size and save again to re-enable this rule.
Tamper Protection 832 Warning

Execution of '$filePathAndName$' by '$username$' was blocked because tamper protection was enabled.

Modification of '$filePathAndName$' by '$username$' was blocked because tamper protection was enabled.

Execution of '$filePathAndName$' by '$username$' would have been blocked if tamper protection were enabled.

Modification of '$filePathAndName$' by '$username$' would have been blocked if tamper protection were enabled.

Unapproved process discovered 848 Warning

The Carbon Black App Control Agent discovered an unapproved process '$filePathandName$' [$hash$] that ran during system startup. $param1$

User Login denied 853 Warning User '$param1$' prohibited from logging in on computer $computer$.
Write block (Custom Rule) 808 Notice

Modification of file '$filePathAndName$' [$hash$] was blocked because of a Custom Rule.

Write block (Registry Rule) 827 Notice

Modification of registry '$filePathAndName$' was blocked.

Write block (removable media) 820 Notice Modification of file '$filePathAndName$' with hash [$hash$] was blocked because it was on removable media.
Write prompt (Custom Rule) 817 Info

File '$filePathAndName$' was modified or deleted because of a Custom Rule user response.

Modification of file '$filePathAndName$' [$hash$] was blocked because of a Custom Rule user response.

Write prompt (Registry Rule) 828 Info

Registry '$filePathAndName$' was modified or deleted because of a Registry Rule user response.

Modification of registry '$filePathAndName$' was blocked because of a Registry Rule user response.