Home
Carbon Black App Control User Guide
DASCLI
The DasCLI.exe program, referred to as DASCLI, is an executable which provides Command Line Interface (CLI) access to the Carbon Black App Control Windows Agent. Messages are transmitted between DASCLI and the Agent.
shepherd (alias for server)
See the DASCLI server command.

Carbon Black App Control User Guide
- Preface
  This is your guide to day-to-day administration and security monitoring tasks: monitoring executable files on your network using App Control; configuring the App Control Server; managing computers running the App Control Agent; and managing App Control Console users.
- App Control Overview
- Using the Console
  This section covers the basics of using the Carbon Black App Control Console: how to log in and out, how to navigate in the user interface from the Home page and menu system, and how to view the information Carbon Black App Control makes available to you through tables, details pages, and dashboards.
- Managing Console Login Accounts
  This section describes how to create and manage login accounts for the Carbon Black App Control Console. It also describes how to define user roles that grant access to specified features, and in some cases limit this access by policy.
- Managing Computers
  This section describes the steps necessary to install Carbon Black App Control agents on computers. It also describes how to upgrade or uninstall agents, view the details agents provide to the Carbon Black App Control Console and manage operating system updates on agent-managed systems.
- Creating and Configuring Policies
  This section explains how to create policies and change their settings, including Enforcement Levels.
- Managing Virtual Machines
  This section explains how Carbon Black App Control efficiently manages virtual machines, called clones in the console, and the template computers on which they are based.
- File, Publisher, and Application Information
  This section describes the location and contents of file information in Carbon Black App Control. It also includes:
- Approving and Banning Software
  This section describes how to approve or ban software using Carbon Black App Control. It includes information about both global and local file approval.
- Deleting Files
  This section describes how to use the Carbon Black App Control Console to delete files on Windows endpoints.
- Reputation Approval Rules
  This section describes reputation approval rules, which can be used to automatically approve files based on the file and publisher trust ratings that Carbon Black File Reputation provides.
- Managing File-Signing Certificates
  This section describes advanced features for using file-signing certificates in Carbon Black App Control file monitoring and enforcement activities.
- Managing Devices
  This section describes features for tracking and control of storage devices detected on computers running the Carbon Black App Control Agent.
- Custom Software Rules
  Custom rules define actions you want the agent to take in response to file, directory, or process activity that matches conditions you specify. They may be used to optimize performance, protect file integrity, create a trusted file path for software distribution, or meet other special needs
- Memory Rules
  Memory Rules let you protect a process from being accessed or altered by other processes or users.
- Registry Rules
  This chapter describes Registry rules, which control what happens when there is an attempt to make changes in the Windows Registry at locations that match paths you specify. If you choose, you can limit enforcement of the rules to specified users and/or processes.
- Script Rules
  This chapter describes Script rules, which identify files to be tracked and managed as scripts by Carbon Black App Control. The Carbon Black App Control Server includes built-in script rules, and you can create custom rules to identify other scripts.
- YARA Rules
  Carbon Black App Control provides content-based inspection by using YARA rules, which enables more granular control of the security policy in your environment. YARA rules are descriptions of malware samples that can help you detect and classify malware in files. In a rule, the criteria for the rule is defined and tags are specified. When the rule is enabled, tags are assigned to files that meet the criteria for the rule.
- Expert Rules
  Expert rules are Custom, Memory, and Registry rules created with a special interface that provides many more options than the standard interface for these rules. They are intended for expert users working with Carbon Black Support or Technical Services.
- Rapid Configs
  This chapter describes Rapid Configs, which are sets of rules that can be used to accomplish tasks such as application optimization, operating system and application hardening, and approval of files delivered by software distribution systems.
- Event Rules
  There are Event rules, which allow you to specify an action to be performed when an event matches filters you define.
- Endpoint Notifiers and Approval Requests
  This chapter describes the Carbon Black App Control features that involve interactions with endpoint users.
- Events, Alerts and Meters
  This section explains how to use Carbon Black App Control event reports and alerts to monitor file activity and other key operations on your network. It also describes tools for detecting propagation of files on your network and for keeping track of the number of times a specified file executes.
- Monitoring Change: Baseline Drift Reports
  This section describes how to use Baseline Drift Reports, which allow you to track changes in the inventory of files on systems running the Carbon Black App Control Agent.
- Advanced Threat Detection
  This section describes how you enable and use Carbon Black App Control’s Advanced Threat Indicators, and how you can monitor threats through events, file details, and alerts.
- Using and Customizing Dashboards
  Carbon Black App Control Dashboards are configurable pages containing compact windows called portlets, each of which provides access to Carbon Black App Control-related information or controls.
- Locating Files
  This section describes how to use the Find Files page to locate or verify the existence of specific executable files on computers running the Carbon Black App Control Agent. Find Files locates instances of files, not their listings in the File Catalog.
- System Configuration
  This section describes settings that enable you to configure and maintain your Carbon Black App Control Server installation. Access to the System Configuration page is available only to login accounts in the Administrators group or in customized groups with View System Configuration and Manage System Configuration check boxes selected.
- Unified Management of Multiple Servers
  If you have multiple Carbon Black App Control servers, you can centralize the management of those servers. Unified Management allows you to specify that one server can control many common management functions for any connected Carbon Black App Control servers.
- Monitoring System Health
  This section introduces the System Health page, which provides Carbon Black App Control administrators with the ability to monitor the health and performance of the Carbon Black App Control Server.
- Live Inventory SDK: Database Views
  In addition to the access provided to the Live Inventory of files and computers through the console, Carbon Black App Control provides public views into the database. You can create your own reporting and data analysis solutions through the use of these public views.
- Carbon Black App Control API
  The Carbon Black App Control API is intended for programmers who want to write code to interact with Carbon Black App Control, either using custom scripts or from other applications. It is a RESTful API that can be consumed over HTTPS protocol using any language that can create get URI requests and post/put JSON requests as well as interpret JSON responses.
- Carbon Black App Control Connector
  This section provides instructions for configuring and using the Connector, which integrates the Carbon Black App Control Server with one or more network security devices or services.
- DASCLI
  The DasCLI.exe program, referred to as DASCLI, is an executable which provides Command Line Interface (CLI) access to the Carbon Black App Control Windows Agent. Messages are transmitted between DASCLI and the Agent.
  - ? (alias for help)
    See the DASCLI help command.
  - abcount
    The DASCLI abcount command displays a count of tracked files.
  - abstate
    The DASCLI abstate command changes the AB state of all instances of a file or hash identifier on an endpoint to a given state.
  - allowuninstall
    The DASCLI allowuninstall command allows or prevents the uninstallation of the agent, or reports on the state.
  - analysis (alias for analyze)
    See the DASCLI analyze command.
  - analyze
    The DASCLI analyze command instructs the agent to generate and display an analysis of potential issues.
  - analyzenow
    The DASCLI analyzenow command instructs the agent to immediately analyze a file and display an analysis of potential issues for this agent.
  - autostart
    The DASCLI autostart command instructs the agent to list autostart files.
  - bookmark
    The DASCLI bookmark command instructs the agent to add a name to the list of bookmarks and copy the cache database. The name is used as a prefix to the name of the database copy.
  - capture
    The DASCLI capture command instructs the agent to generate a ZIP file of diagnostic data stored in a file.
  - certchain
    The DASCLI certchain command displays a certificate chain by hash identifier or certificate ID.
  - certfind
    The DASCLI certfind command displays all files on the endpoint which are associated with a certificate.
  - certificates
    The DASCLI certificates command displays cached certificate information.
  - certinfo
    The DASCLI certinfo command displays certificate information for a file or all files in a directory.
  - certstates
    The DASCLI certstates command displays the state of all certificates that have a certificate state other than unapproved.
  - certwvt
    The DASCLI certwvt command runs the WinVerify Trust function on the specified file.
  - checkcache
    The DASCLI checkcache command instructs the agent to correct cache problems and report the cache status.
  - classifications
    The DASCLI classifications command displays current classification and tags.
  - clcounts
    The DASCLI clcounts command instructs the agent to get the current configuration list counts.
  - comment
    The DASCLI comment command adds a comment to a diagnostic trace.
  - configlist
    The DASCLI configlist command prints the current configuration list version.
  - configlistrefresh
    The DASCLI configlistrefresh command forces a configuration list refresh from the server.
  - configprops
    The DASCLI configprops command displays active configuration properties.
  - connect
    The DASCLI connect command initiates an attempt on the agent to connect to the server.
  - counters
    The DASCLI counters command displays counter information for the local agent.
  - crawlinfo
    The DASCLI crawlinfo command displays a crawler file analysis for the specified file or directory.
  - debuglevel
    The DASCLI debuglevel command sets the agent debug level or reports the debug state.
  - deleteDB
    The DASCLI deleteDB command schedules the deletion of the agent cache database.
  - deleterule
    The DASCLI deleterule command deletes the specified rule.
  - devices
    The DASCLI devices command displays attached devices.
  - dirty
    The DASCLI dirty command displays current dirty entries.
  - disconnect
    The DASCLI disconnect command instructs the agent to disconnect from the server and not to attempt to connect again unless instructed to do so or an agent service restart is performed.
  - enforcement
    The DASCLI enforcement command displays or changes the enforcement level.
  - fileassoc
    The DASCLI fileassoc command prints the file or protocol associated with the specified file extension.
  - files
    The DASCLI files command displays files actively under analysis.
  - filter
    The DASCLI filter command is appended to a command to filter its output.
  - find
    The DASCLI find command finds a file object by file name or hash identifier and optional qualifiers.
  - flushlogs
    The DASCLI flushlogs command deletes parity log files.
  - hash
    The DASCLI hash command generates a hash of the specified type or creates a bulk import list for the specified file.
  - healthcheck
    The DASCLI healthcheck command runs a health check test of the agent.
  - help
    The DASCLI help command displays available commands.
  - hostgroup
    The DASCLI hostgroup command prints the current host group identifier.
  - importconfiglist
    The DASCLI importconfiglist command loads the specified configuration list.
  - info (alias for status)
    See the DASCLI status command.
  - initializationallowed
    The DASCLI initializationallowed allows agent initialization without the approval of the server.
  - installs
    The DASCLI installs command displays installation events.
  - isconnected
    The DASCLI isconnected command checks if the agent is connected to the server.
  - isinitializing
    The DASCLI isinitializing command checks if the agent is being initialized.
  - isinsession
    The DASCLI isinsession command checks if the agent is in session with the server.
  - issleeping
    The DASCLI issleeping command checks if the agent is in sleep mode.
  - kernelconfig
    The DASCLI kernelconfig command sends a name and value property to the kernel.
  - kerneltrace
    The DASCLI kerneltrace command activates kernel tracing.
  - knormalize
    The DASCLI knormalize command shows the kernel normalized form of a file path.
  - links
    The DASCLI links command displays all hard links for a file.
  - logonsessions
    The DASCLI logonsessions command displays logon sessions and interactive users.
  - metadata
    The DASCLI metadata command displays metadata information about a file.
  - nettrace
    The DASCLI nettrace command activates or deactivates network tracing, or reports the tracing state.
  - password
    The DASCLI password command provides authorization for the use of controlled DASCLI commands.
  - policy
    The DASCLI policy command adds or deletes policies from the XML file or query specified, or from all policy types.
  - prioritize
    The DASCLI prioritize command prioritizes communication with the Carbon Black App Control Server.
  - process
    The DASCLI process command shows process information by process ID.
  - processes
    The DASCLI processes command shows the process list.
  - queues
    The DASCLI queues command displays outstanding queue items.
  - resetcounters
    The DASCLI resetcounters command resets counters back to zero.
  - restoreDB
    The DASCLI restoreDB command restores the agent cache database from backup. The backups are saved once every hour unless there is a problem.
  - resync
    The DASCLI resync command resends the entire file catalog to the server.
  - revertcliconfigprops
    The DASCLI revertcliconfigprops command reverts all configuration properties set from the Command Line Interface (CLI).
  - ruletags
    The DASCLI ruletags command adds or deletes classification tags, or lists the current tags.
  - runtimer
    The DASCLI runtimer command schedules a timer to run immediately.
  - seccon (alias for enforcement)
    See the DASCLI enforcement command.
  - selfprotect (alias for tamperprotect)
    See the DASCLI tamperprotect command.
  - server
    The DASCLI server command displays the address of the server.
  - servernamecheck
    The DASCLI servernamecheck command displays or sets SSL CN validation.
  - setconfigprop
    The DASCLI setconfigprop command sets an agent configuration property to the specified value.
  - shepherd (alias for server)
    See the DASCLI server command.
  - showblist (alias for shownamebans)
    See the DASCLI shownamebans command.
  - showconfigprops (alias for configprops)
    See the DASCLI configprops command.
  - showcounters (alias for counters)
    See the DASCLI counters command.
  - showmempolicies (alias for showmemorypolicies)
    See the DASCLI showmemorypolicies command.
  - showmemorypolicies
    The DASCLI showmemorypolicies command displays the memory policies for the agent.
  - shownamebans
    The DASCLI shownamebans command displays a list of blocks by name.
  - showobjectpolicies (alias for showmemorypolicies)
    See the DASCLI showmemorypolicies command.
  - showpapaths
    The DASCLI showpapaths command displays the preapproval folders on the host.
  - showpathpolicies
    The DASCLI showpathpolicies command displays the path policies for the host.
  - showpublisherstates
    The DASCLI showpublisherstates command shows publisher policies.
  - showregpolicies
    The DASCLI showregpolicies command shows the registry policies for the host.
  - showregistrypolicies (alias for showregpolicies)
    See the DASCLI showregpolicies command.
  - showscriptpolicies
    The DASCLI showscriptpolicies command shows the script policies for the host.
  - showsysteminfo (alias for systeminfo)
    See the DASCLI systeminfo command.
  - showtrusted
    The DASCLI showtrusted command displays trusted installer processes.
  - showupgradehistory (alias for showupgrades)
    See the DASCLI showupgrades command.
  - showupgrades
    The DASCLI command shows agent upgrade information.
  - sidinfo
    The DASCLI sidinfo command shows information about a security identifier (SID), user, or group.
  - sslmode
    The DASCLI sslmode command sets the SSL mode or reports the current setting.
  - status
    The DASCLI status command provides information about the status of an upgrade.
  - systeminfo
    The DASCLI systeminfo command shows various types of system information.
  - tags (alias for classifications)
    See the DASCLI classifications command.
  - tamperprotect
    The DASCLI tamperprotect command activates or deactivates tamper protection, or shows the current state.
  - testpattern
    The DASCLI testpattern command evaluates whether a given pattern matches a name.
  - timers
    The DASCLI timers command displays outstanding timers.
  - trustedusers
    The DASCLI trustedusers command lists active trusted users, that is, trusted users that are logged in. It does not list all trusted users.
  - updatemsiinfo
    The DASCLI updatemsiinfo command rescans MSI file groups.
  - uploaddiagnostics
    The DASCLI uploaddiagnostics command collects and uploads diagnostics to the Carbon Black App Control Server service (ParityServer).
  - users
    The DASCLI users command lists users that are logged on.
  - validatecerts
    The DASCLI validatecerts command revalidates certificates.
  - version
    The DASCLI version command displays agent version information.
  - volumes
    The DASCLI volumes command displays volume information.
  - wait
    The DASCLI wait command waits until a condition is true.
  - windowsupdates
    The DASCLI windowsupdates command displays a summary of installed Windows updates.
  - yara
    The DASCLI yara command instructs the agent to import YARA rules from a file.
- Diagnostic Files
  The Carbon Black App Control Console includes a page that displays certain diagnostic files for the Carbon Black App Control Server and its agents. These files can be useful when you are investigating issues in your Carbon Black App Control environment with the assistance of Carbon Black Support.
- Uploading Files from Agents
  This topic describes uploading files from agents.
- Exporting Data for External Analysis
  This section provides instructions for configuring and using Carbon Black App Control External Analytics, which enables the Carbon Black App Control Server to export data it collects from endpoints to external analysis tools.

shepherd (alias for server)

See the DASCLI server command.

This command is an alias for the DASCLI server command.