Carbon Black App Control supports installation of agents on Windows, macOS, and Linux computers. Because of the different platform software and applications found on different operating systems, it does not make sense to mix these different computers in a drift measurement.
The noise level makes extraction of useful data difficult. Targeting all computers or all computers in a policy (unless the policy is platform-specific) in a drift report is not recommended.
If you have a multi-platform environment, possible ways to define a report that produces useful results are:
- Choose None as the Baseline Type. This will produce a report that monitors all changes on a target set of machines since the agent was installed, without tracking of missing files. By default, it lists all unapproved files on your target systems, along with additional Drift and Risk information.
- Choose Same as Target as the Baseline Type. This will produce a report that shows only the drift of each computer compared to itself.
- For other baseline types, you can create one drift report for each platform by choosing an Advanced Filter or Computer Filter on the Target menu and specifying the platform in that filter.
See Creating Baseline Drift Alerts for more information about specifying the parameters in a drift report.
