In the App Control console, you can view Carbon Black EDR statistics on files.

  • Number of associated watchlists.

  • Number of computers and processes in which the file has been found.

Note:

For Windows 5.1.1 and previous sensors, Carbon Black EDR process information is available to App Control. Process information is not available in App Control from the Carbon Black EDR macOS or Linux sensors.

To view Carbon Black EDR details for a file on an App Control-managed computer:

  1. In the App Control console, click Assets > Files .

  2. Click the File Catalog tab to view a table of unique files that are discovered on computers that this App Control server manages. You can also select Files on Computers to view a table of all file instances.

  3. Click the View Details icon (file and pencil) on the left of that file row.

cbp-filedetails-cbr
Table 1. Carbon Black EDR fields on App Control File/File Instance Details pages

Field

Description

First Seen Activity

The date and time when activity involving this file was first reported to the Carbon Black EDR server.

Watchlists

The number of Carbon Black EDR watchlists on which this file appears. This appears if watchlist export is configured on the App ControlSystem Configuration page for Carbon Black EDR.

Frequency Data

The frequency of the file is the number of endpoints that have this file associated with a process. The number of processes is the count of all processes that have been associated with this file.

Unique Paths

The number of unique paths in which this file has been seen (only appears if data is available).

Network Connections

Whether there have been any network connections associated with this file, and if so, on how many computers (only appears if data is available).

Registry Modifications

Whether there have been any registry modifications associated with this file, and if so, on how many computers (only appears if data is available).

File Icon

The icon for this file (if any).

More information

Link to the Carbon Black EDR console showing more information about this file (from the File Details page) or a particular instance of this file on a particular computer (from the File Instance Details page). See See Links to the Carbon Black EDR Console.