Files are classified according to their state. Security policies, which are groups of rules, control how files are treated based on their state. There are two types of states: global and local. The main states a file can be are approved, banned, and unapproved.

Global state determines what the file is allowed to do on agent-managed computers. The global state is a combination of file state and publisher state. File state is the approval/ban state of the file itself while publisher state is the approval state of the file’s publisher (if it is known). For example, a file may be unapproved but comes from an approved publisher (ex: Microsoft) leading to a global state of approved. Global states are:

• Approved for all computers
• Approved by Policy (approved by some, unapproved for others)
• Unapproved for all computers
• Banned for all computers
• Banned by Policy (banned for some, unapproved for others)
• Mixed (banned for some, approved for others)

While App Control keeps a global state for a file, each instance of a file on a computer has its own local state. Local state indicates what the file is allowed to do on the computer it was found on. Local states are:

• Approved
• Banned
• Unapproved
• Deleted (file has been deleted and will be removed from database on next update)

If a file has a global state of unapproved, it may have a different local state. For example, in the Medium Enforcement Level (see enforcement level section for additional details) a user can locally approve an unapproved file to run  giving the file a local state of approved.

Rapid Configs are pre-built sets of custom rules that can be used to achieve more complex goals. They are curated by Carbon Black and built-in to the App Control solution. Rapid configs can accomplish use cases such as optimizing the interaction of App Control and a specific app, hardening of OS and apps, and approval of files created or delivered by certain tools or pathways.

One example of a rapid config is the Microsoft SCCM rule. This rule approves software that is delivered by SCCM. This offloads manual approval of applications that IT administrators push out via SCCM to a perpetual and automated method.

Rapid configs are continuously updated by Carbon Black. A recent addition to the rapid config ruleset is the SolarWinds-Sunburst Protection rule. This rule prevents exploitation of the SolarWinds breach. For more detailed information about the rules in this rapid config see the following resource (must be current Carbon Black customer w/access to User Exchange to view): SolarWinds Rapid Configs

Updater rules permit users to install application updates from approved sources as they become available for download. The list of updater rules are curated by Carbon Black. These rules allow for automated approval for trusted change  allowing updates to selected applications.

On the one-time initialization scan, App Control discovers each unique publisher identified in a valid certificate for a file.

Administrators can choose to approve, ban, or leave unapproved publishers that have been identified in the environment. A publisher can be approved for all computers or those in a specific policy.

A file identified as being from a publisher can only be approved by publisher if the certificates are considered valid by the operating system.

Reputation approval rules are used to automatically approve files based on the file and publisher trust ratings. Automatic approval using reputation can give end users flexibility and reduce the effort of maintaining approvals.

Trust ratings are assigned by  Carbon Black File Reputation, which provides a cloud-based database of known files. Trust rating data combines file information from distribution partners, web crawlers, honeypots, and the Carbon Black user community. Reputation data provides context such as publisher and associated product (if any). The prior mentioned information is used by Carbon Black File Reputation to assign a threat level and trust rating (note: trust rating is also provided for publishers).

File trust ratings are given on a scale from 0 (lowest trust) to 10 (highest trust). Apps distributing known malicious software, for example, would have a trust value at or near 0. A signed OS file with no known vulnerabilities would have a trust value near 10.

Publisher trust ratings have four possible values: high, medium, low, and not trusted.

There are a number of options for reputation approval:

• Approval based on file or publisher reputation
• Approval based on a combination of file and publisher reputation
• Approval based on trust threshold (ex: approve if file trust is greater than 8)

When implementing reputation rules it is important to consider rule scope. Reputation rules can be enabled for all endpoints with an App Control agent or by specific policy groups.

In addition, reputation approvals can be disabled for specific files or publishers you don't want to automatically approve. For example you may want to implement trust based on threshold but disable approval for the publisher Adobe, which has a high trust level.

App Control offers administrators the capability to implement Custom Rules to address unique environmental concerns or use cases. Custom Rules define actions you want the agent to take in response to file, directory, or process activity that matches conditions you specify. They may be used to optimize performance, protect file integrity, create trusted file path for software distribution, or meet other special needs.

Many use cases can be fulfilled with Custom Rules including File Integrity Control (FIC). The following fields are used to create a custom rule:

Additional use cases for Custom Rules include but are not limited to:

• File Integrity Control/File Integrity Monitoring (FIC/FIM)
• Creating exception to other types of rules (such as approvals or bans)
• Execution control
• Approve files from software distributors
• Allow installers to run only from trusted network path

Given the flexibility of Custom Rules, rules can be created to suit any number of use cases.

Event Rules allow you to specify an action to be performed when a file- or computer-related event occurs that matches filters you define. Only events that relate to files or computers can be used to trigger these rules.

One common use case of an event rule is to take an action when a malicious file is detected.

A variety of actions are available to be taken when an event rules' criteria is met. You can chose to:

• Change global file state
• Change global process state
• Change local file state
• Upload a file
• Delete a file
• Analyze a file
• Move computer (to a different policy)