In the Carbon Black App Control console, you can view Carbon Black EDR file and process statistics. This information includes the number of associated watchlists and the number of computers and processes in which a file has been found.

Note:

For Windows 5.1.1 and previous sensors, Carbon Black EDR process information is available to Carbon Black App Control. Process information is not available in Carbon Black App Control from the Carbon Black EDR macOS or Linux sensors.

Procedure

  1. In the Carbon Black App Control console, click Assets > Files.
  2. Click the File Catalog tab to view a table of unique files that are discovered on computers that this Carbon Black App Control server manages. You can also select Files on Computers to view a table of all file instances.
  3. Click the View Details icon (file and pencil) on the left of that file row.
    The CB response section on the File Details page
    Table 1. Carbon Black EDR fields on Carbon Black App Control File/File Instance Details pages

    Field

    Description

    First Seen Activity

    The date and time when activity involving this file was first reported to the Carbon Black EDR server.

    Watchlists

    The number of Carbon Black EDR watchlists on which this file appears. This appears if watchlist export is configured on the App ControlSystem Configuration page for Carbon Black EDR.

    Frequency Data

    The frequency of the file is the number of endpoints that have this file associated with a process. The number of processes is the count of all processes that have been associated with this file.

    Unique Paths

    The number of unique paths in which this file has been seen (only appears if data is available).

    Network Connections

    Whether there have been any network connections associated with this file, and if so, on how many computers (only appears if data is available).

    Registry Modifications

    Whether there have been any registry modifications associated with this file, and if so, on how many computers (only appears if data is available).

    File Icon

    The icon for this file (if any).

    More information

    Link to the Carbon Black EDR console showing more information about this file (from the File Details page) or a particular instance of this file on a particular computer (from the File Instance Details page). See See Links to the Carbon Black EDR Console.