Carbon Black App Control provides a mechanism for automatic periodic updates to Indicator Sets.

Updates can involve entirely new Indicator Sets, new indicators added to existing sets, reorganization of Indicator Sets, or changes to existing indicators. These changes are delivered automatically when available if both of the following are true:

You can leave automatic updates enabled all the time or temporarily enable updates periodically. Updates are scheduled to be delivered within 24 hours and often appear sooner than that.

If you receive automatic updates, the state of Indicator Sets is as follows:

  • New Indicator Sets are added in a disabled state.
  • Existing Indicator Sets remain enabled or disabled according to the state they were in prior to updating. This is true even if the upgrade adds or modifies threat indicators in the existing Indicator Set.