Home
Carbon Black App Control User Guide
Approving and Banning Software
This section describes how to approve or ban software using Carbon Black App Control. It includes information about both global and local file approval.
File-Specific Rules: Approvals and Bans
The Files tab of the Software Rules page shows all of the approvals and bans created forindividual files. These rules identify specific files by hash or optionally by file name (for bans only).
Create an Approval or Ban from the Software Rules Page
To create and configure an approval or ban for a single file, perform the following procedure.

Carbon Black App Control User Guide
- Preface
  This is your guide to day-to-day administration and security monitoring tasks: monitoring executable files on your network using App Control; configuring the App Control Server; managing computers running the App Control Agent; and managing App Control Console users.
- App Control Overview
- Using the Console
  This section covers the basics of using the Carbon Black App Control Console: how to log in and out, how to navigate in the user interface from the Home page and menu system, and how to view the information Carbon Black App Control makes available to you through tables, details pages, and dashboards.
- Managing Console Login Accounts
  This section describes how to create and manage login accounts for the Carbon Black App Control Console. It also describes how to define user roles that grant access to specified features, and in some cases limit this access by policy.
- Managing Computers
  This section describes the steps necessary to install Carbon Black App Control agents on computers. It also describes how to upgrade or uninstall agents, view the details agents provide to the Carbon Black App Control Console and manage operating system updates on agent-managed systems.
- Creating and Configuring Policies
  This section explains how to create policies and change their settings, including Enforcement Levels.
- Managing Virtual Machines
  This section explains how Carbon Black App Control efficiently manages virtual machines, called clones in the console, and the template computers on which they are based.
- File, Publisher, and Application Information
  This section describes the location and contents of file information in Carbon Black App Control. It also includes:
- Approving and Banning Software
  This section describes how to approve or ban software using Carbon Black App Control. It includes information about both global and local file approval.
  - Carbon Black App Control Software Approval
    Software approval ensures that users of computers running the Carbon Black App Control Agent can install and run known-good applications regardless of the Carbon Black App Control security settings and Enforcement Level in effect.
  - Carbon Black App Control Software Bans
    File bans are rules that block specific files from executing on computers running the Carbon Black App Control Agent, based on the agent Enforcement Level.
  - Approving by Updater
    Updater Approval Rules permit users of computers under High Enforcement protection to install application updates from approved sources as they become available for download.
  - Approving by Trusted Directory
    If your organization uses software deployment tools, or to dedicate a computer for software approval, you can use a trusted directory to automatically approve software during regular roll-outs.
  - Approving by Trusted User or Group
    Carbon Black App Control supports installation privileges for users to install software on their own or others’ computers when the computers are under High Enforcement protection. You can trust individual users or specify trusted groups whose members become trusted users.
  - Approving or Banning by Publisher
    Many files are signed with a digital certificate that verifies the integrity and identity of the file, including the name of its publisher.
  - Locally Approving Files
    When the Carbon Black App Control Agent is installed on a computer for the first time, the computer goes through an initialization process during which all files present on that computer are locally approved unless they are already globally approved or banned.
  - File-Specific Rules: Approvals and Bans
    The Files tab of the Software Rules page shows all of the approvals and bans created forindividual files. These rules identify specific files by hash or optionally by file name (for bans only).
    - Report Only Bans
      Creating a Ban (Report Only) rule lets you observe how a ban can affect your users. With a report-only ban, the file is not blocked but warnings are written to the Events log.
    - Approvals and Bans of MSI Files by Hash
      MSI files include timestamps that typically are unique on each endpoint, and this causes the hash of the same MSI file to be different on every machine. This affects hash approvals and bans of MSI files in two ways.
    - Create an Approval or Ban from the Software Rules Page
      To create and configure an approval or ban for a single file, perform the following procedure.
      - File Rule Parameters
        The following table describes File Rule parameters.
      - Editing and Deleting File Rules
        You can modify or delete an existing File rule.
    - Creating File Approvals and Bans from Table Pages
      You can create an approval or ban rule from the Files page (File Catalog or Files on Computers) and any other console page that lists files, including pages in which the file is not the primary object. Generally, a row with a check box next to a filename allows creation of bans and approvals from the Action menu:
    - Approve or Ban a Single File using the File Details Page
      Although you can approve or ban files from tables, you might want more information about the file before you decide to ban it. To do this, go to the File Details page.
    - Approving or Banning Lists of Files
      If you have a list of hashes for files, you can import the list in a text file as input to the console and change the state of these files in one operation. You can change the file state to Approved, Banned, or Ban (Report Only), and you can do this for some or all policies.
    - Enabling Bans to Stop Running Processes
      By default, file bans stop future attempts to execute a file but do not terminate processes that are already running on an agent-managed system.
- Deleting Files
  This section describes how to use the Carbon Black App Control Console to delete files on Windows endpoints.
- Reputation Approval Rules
  This section describes reputation approval rules, which can be used to automatically approve files based on the file and publisher trust ratings that Carbon Black File Reputation provides.
- Managing File-Signing Certificates
  This section describes advanced features for using file-signing certificates in Carbon Black App Control file monitoring and enforcement activities.
- Managing Devices
  This section describes features for tracking and control of storage devices detected on computers running the Carbon Black App Control Agent.
- Custom Software Rules
  Custom rules define actions you want the agent to take in response to file, directory, or process activity that matches conditions you specify. They may be used to optimize performance, protect file integrity, create a trusted file path for software distribution, or meet other special needs
- Memory Rules
  Memory Rules let you protect a process from being accessed or altered by other processes or users.
- Registry Rules
  This chapter describes Registry rules, which control what happens when there is an attempt to make changes in the Windows Registry at locations that match paths you specify. If you choose, you can limit enforcement of the rules to specified users and/or processes.
- Script Rules
  This chapter describes Script rules, which identify files to be tracked and managed as scripts by Carbon Black App Control. The Carbon Black App Control Server includes built-in script rules, and you can create custom rules to identify other scripts.
- YARA Rules
  Carbon Black App Control provides content-based inspection by using YARA rules, which enables more granular control of the security policy in your environment. YARA rules are descriptions of malware samples that can help you detect and classify malware in files. In a rule, the criteria for the rule is defined and tags are specified. When the rule is enabled, tags are assigned to files that meet the criteria for the rule.
- Expert Rules
  Expert rules are Custom, Memory, and Registry rules created with a special interface that provides many more options than the standard interface for these rules. They are intended for expert users working with Carbon Black Support or Technical Services.
- Rapid Configs
  This chapter describes Rapid Configs, which are sets of rules that can be used to accomplish tasks such as application optimization, operating system and application hardening, and approval of files delivered by software distribution systems.
- Event Rules
  There are Event rules, which allow you to specify an action to be performed when an event matches filters you define.
- Endpoint Notifiers and Approval Requests
  This chapter describes the Carbon Black App Control features that involve interactions with endpoint users.
- Events, Alerts and Meters
  This section explains how to use Carbon Black App Control event reports and alerts to monitor file activity and other key operations on your network. It also describes tools for detecting propagation of files on your network and for keeping track of the number of times a specified file executes.
- Monitoring Change: Baseline Drift Reports
  This section describes how to use Baseline Drift Reports, which allow you to track changes in the inventory of files on systems running the Carbon Black App Control Agent.
- Advanced Threat Detection
  This section describes how you enable and use Carbon Black App Control’s Advanced Threat Indicators, and how you can monitor threats through events, file details, and alerts.
- Using and Customizing Dashboards
  Carbon Black App Control Dashboards are configurable pages containing compact windows called portlets, each of which provides access to Carbon Black App Control-related information or controls.
- Locating Files
  This section describes how to use the Find Files page to locate or verify the existence of specific executable files on computers running the Carbon Black App Control Agent. Find Files locates instances of files, not their listings in the File Catalog.
- System Configuration
  This section describes settings that enable you to configure and maintain your Carbon Black App Control Server installation. Access to the System Configuration page is available only to login accounts in the Administrators group or in customized groups with View System Configuration and Manage System Configuration check boxes selected.
- Unified Management of Multiple Servers
  If you have multiple Carbon Black App Control servers, you can centralize the management of those servers. Unified Management allows you to specify that one server can control many common management functions for any connected Carbon Black App Control servers.
- Monitoring System Health
  This section introduces the System Health page, which provides Carbon Black App Control administrators with the ability to monitor the health and performance of the Carbon Black App Control Server.
- Live Inventory SDK: Database Views
  In addition to the access provided to the Live Inventory of files and computers through the console, Carbon Black App Control provides public views into the database. You can create your own reporting and data analysis solutions through the use of these public views.
- Carbon Black App Control API
  The Carbon Black App Control API is intended for programmers who want to write code to interact with Carbon Black App Control, either using custom scripts or from other applications. It is a RESTful API that can be consumed over HTTPS protocol using any language that can create get URI requests and post/put JSON requests as well as interpret JSON responses.
- Carbon Black App Control Connector
  This section provides instructions for configuring and using the Connector, which integrates the Carbon Black App Control Server with one or more network security devices or services.
- DASCLI
  The DasCLI.exe program, referred to as DASCLI, is an executable which provides Command Line Interface (CLI) access to the Carbon Black App Control Windows Agent. Messages are transmitted between DASCLI and the Agent.
- Diagnostic Files
  The Carbon Black App Control Console includes a page that displays certain diagnostic files for the Carbon Black App Control Server and its agents. These files can be useful when you are investigating issues in your Carbon Black App Control environment with the assistance of Carbon Black Support.
- Uploading Files from Agents
  This topic describes uploading files from agents.
- Exporting Data for External Analysis
  This section provides instructions for configuring and using Carbon Black App Control External Analytics, which enables the Carbon Black App Control Server to export data it collects from endpoints to external analysis tools.

Create an Approval or Ban from the Software Rules Page

To create and configure an approval or ban for a single file, perform the following procedure.

On the console menu, click Rules > Software Rules.
Click the Files tab.
Click the Add File Rule button. The Add File Rule page opens, with Approval as the default Rule Type.
Specify the rule details and the file to be approved or banned. See File Rule Parameters for a full list of parameters and rule information.

Note: Additional options appear on the Add File Rule page if you have enabled Unified Management of multiple servers. See Unified Management of Rules.
1. Provide a Rule Name to identify the rule in the table.
2. Select the Rule Type — Approval, Ban, or Ban (Report Only). If you select Ban, a warning states that the Ban can stop matching files that are currently running. See Enabling Bans to Stop Running Processes.
3. If the rule is a Ban, choose the Type (Hash or File Name).
4. For Hash rules, specify the type of hash (MD5,SHA-1,or SHA-256).
5. For File Name Bans, select the platform to which the rule will apply (Windows, macOS, or Linux).
6. Enter the Hash Value or File Name that will identify the file.
7. Optionally, provide a Description.
8. In the Rule Applies To field, select All policies or specify the Selected policies to which the rule will apply.
To create the approval or ban, click Save.

The rule appears on the File Rules table. Group the table by Type (the default) to see Bans together, Report Only bans together, and Approvals together.