Recommendations in the Audit Log

You can use the audit log to view all the actions performed on the recommendations and the associated reputations in your organization.

To access the audit log content in the Carbon Black Cloud console, navigate to the Settings > Audit Log page, and search for a recommendation. The search result reprsents each action on the recommendations in a certain format depending on the recommendations type and status.

You can export the filtered content into a .csv file through the download icon .

For more information, see Audit Log.

Hash Recommendations

Audit Log Template	Example
Template for accepted recommendations: User <user email> accepted recommendation ID <recommendation ID>. Added SHA-256 hash (<hash> | <app name>) to <list type> list. Comment: <“comment from Recommendations page”>	Reputation log example: User [email protected] added Reputation Override for Organization ID 1 of type SHA256 to WHITE_LIST with content: 56f560d8254ebb453daeaf9abe5c3c6de2e18eafaa5a9e40e0348e9b21931fa3 | zoom.exe Recommendations log example User [email protected] accepted recommendation ID: 13985y13. Added SHA-256 hash (56f560d8254ebb453daeaf9abe5c3c6de2e18eafaa5a9e40e0348e9b21931fa3 | zoom.exe) to approved list. Comment: “This is a comment on the Recommendations page”
Template for deleted recommendations: User <user email> reverted recommendation ID: <recommendation ID>. Deleted SHA-256 hash (<hash> | <app name>) from <list type> list.	Reputation log example: User [email protected] deleted Reputation Override for Organization ID 1: [80ba7e2cd71611ebbfecdd6d9ebdeae8] Recommendations log example: User [email protected] reverted recommendation ID: 13985y13. Deleted SHA-256 hash (56f560d8254ebb453daeaf9abe5c3c6de2e18eafaa5a9e40e0348e9b21931fa3 | zoom.exe) from approved list.
Template for rejected recommendations: User <user email> rejected recommendation ID: <recommendation ID>.	User [email protected] rejected recommendation ID: 13985y13.
Template for restored recommendations: User <user email> restored recommendation ID: <recommendation ID>.	User [email protected] restored recommendation ID: 13985y13.

IT Tools Recommendations

Audit Log Template	Example
Template for accepted recommendations: User <user email> accepted recommendation ID <recommendation ID>. Added IT Tool path (<path> | child processes <included/excluded>) to <list type> list. Comment: <“comment from Recommendations page”>	Reputation log example: User [email protected] added Reputation Override for Organization ID 1 of type IT_TOOL to WHITE_LIST with content: c:\windows\veeamvsssupport\veeamguesthelper.exe | true Recommendations log example: User [email protected] accepted recommendation ID: 13985y13. Added IT Tool path (c:\windows\veeamvsssupport\veeamguesthelper.exe | child processes included) to approved list. Comment: “I wrote this comment on the Recommendations page”
Template for deleted recommendations: User <user email> reverted recommendation ID: <recommendation ID>. Deleted IT Tool path (<path> | child processes <included/excluded>) from <list type> list.	Reputation log example: User [email protected] deleted Reputation Overrides for Organization ID 1: [dfa48952d64d11eb9b86b5e8605015d7] Recommendations log example: User [email protected] reverted recommendation ID: 13985y13. Deleted IT Tool path (c:\windows\veeamvsssupport\veeamguesthelper.exe | child processes included) from approved list.
Template for rejected recommendations: User <user email> rejected recommendation ID: <recommendation ID>.	User [email protected] rejected recommendation ID: 13985y13.
Template for restored recommendations: User <user email> restored recommendation ID: <recommendation ID>.	User [email protected] restored recommendation ID: 13985y13.