SamplePolicy_POC_05_MacOS-POC-Basic.json

{
  "avSettings": {
    "features": [
      {
        "enabled": false,
        "name": "SIGNATURE_UPDATE"
      },
      {
        "enabled": true,
        "name": "ONACCESS_SCAN"
      },
      {
        "enabled": false,
        "name": "ONDEMAND_SCAN"
      }
    ],
    "updateServers": {
      "servers": [
        {
          "flags": 0,
          "regId": null,
          "server": [
            "http://updates.cdc.carbonblack.io/update"
          ]
        }
      ],
      "serversForOffSiteDevices": [
        "http://updates.cdc.carbonblack.io/update"
      ]
    },
    "apc": {
      "maxFileSize": 4,
      "maxExeDelay": 45,
      "riskLevel": 4,
      "enabled": false
    },
    "onAccessScan": {
      "profile": "NORMAL"
    },
    "onDemandScan": {
      "profile": "NORMAL",
      "scanCdDvd": "AUTOSCAN",
      "scanUsb": "AUTOSCAN",
      "schedule": {
        "days": null,
        "rangeHours": 0,
        "startHour": 0,
        "recoveryScanIfMissed": true
      }
    },
    "signatureUpdate": {
      "schedule": {
        "intervalHours": 4,
        "initialRandomDelayHours": 4,
        "fullIntervalHours": 0
      }
    }
  },
  "sensorSettings": [
    {
      "name": "ALLOW_UNINSTALL",
      "value": "true"
    },
    {
      "name": "SHOW_UI",
      "value": "true"
    },
    {
      "name": "ENABLE_THREAT_SHARING",
      "value": "true"
    },
    {
      "name": "QUARANTINE_DEVICE",
      "value": "false"
    },
    {
      "name": "LOGGING_LEVEL",
      "value": "false"
    },
    {
      "name": "QUARANTINE_DEVICE_MESSAGE",
      "value": "Your device has been quarantined. Please contact your administrator."
    },
    {
      "name": "SET_SENSOR_MODE",
      "value": "0"
    },
    {
      "name": "SENSOR_RESET",
      "value": "0"
    },
    {
      "name": "BACKGROUND_SCAN",
      "value": "true"
    },
    {
      "name": "POLICY_ACTION_OVERRIDE",
      "value": "true"
    },
    {
      "name": "HELP_MESSAGE",
      "value": "Basic Security policy v 1.0"
    },
    {
      "name": "PRESERVE_SYSTEM_MEMORY_SCAN",
      "value": "false"
    },
    {
      "name": "HASH_MD5",
      "value": "false"
    },
    {
      "name": "SCAN_LARGE_FILE_READ",
      "value": "false"
    },
    {
      "name": "SCAN_EXECUTE_ON_NETWORK_DRIVE",
      "value": "true"
    },
    {
      "name": "DELAY_EXECUTE",
      "value": "true"
    },
    {
      "name": "SCAN_NETWORK_DRIVE",
      "value": "false"
    },
    {
      "name": "BYPASS_AFTER_LOGIN_MINS",
      "value": "0"
    },
    {
      "name": "BYPASS_AFTER_RESTART_MINS",
      "value": "0"
    },
    {
      "name": "SHOW_FULL_UI",
      "value": "true"
    },
    {
      "name": "SECURITY_CENTER_OPT",
      "value": "false"
    },
    {
      "name": "CB_LIVE_RESPONSE",
      "value": "true"
    },
    {
      "name": "UNINSTALL_CODE",
      "value": "false"
    },
    {
      "name": "ALLOW_EXPEDITED_SCAN",
      "value": "true"
    }
  ],
  "knownBadHashAutoDeleteDelayMs": null,
  "directoryActionRules": [],
  "rules": [
    {
      "application": {
        "type": "REPUTATION",
        "value": "KNOWN_MALWARE"
      },
      "id": 121,
      "required": false,
      "operation": "RUN",
      "action": "DENY"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "KNOWN_MALWARE"
      },
      "id": 122,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "COMPANY_BLACK_LIST"
      },
      "id": 123,
      "required": false,
      "operation": "RUN",
      "action": "DENY"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "COMPANY_BLACK_LIST"
      },
      "id": 124,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "COMPANY_BLACK_LIST"
      },
      "id": 125,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "SUSPECT_MALWARE"
      },
      "id": 126,
      "required": false,
      "operation": "RUN",
      "action": "DENY"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "SUSPECT_MALWARE"
      },
      "id": 127,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "PUP"
      },
      "id": 128,
      "required": false,
      "operation": "RUN",
      "action": "DENY"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "PUP"
      },
      "id": 129,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "RESOLVING"
      },
      "id": 130,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "ADAPTIVE_WHITE_LIST"
      },
      "id": 131,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "REPUTATION",
        "value": "ADAPTIVE_WHITE_LIST"
      },
      "id": 132,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.docm"
      },
      "id": 133,
      "required": false,
      "operation": "POL_INVOKE_NOT_TRUSTED",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.xlsm"
      },
      "id": 134,
      "required": false,
      "operation": "POL_INVOKE_NOT_TRUSTED",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.pptm"
      },
      "id": 135,
      "required": false,
      "operation": "POL_INVOKE_NOT_TRUSTED",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.docm"
      },
      "id": 136,
      "required": false,
      "operation": "INVOKE_CMD_INTERPRETER",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.xlsm"
      },
      "id": 137,
      "required": false,
      "operation": "INVOKE_CMD_INTERPRETER",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.pptm"
      },
      "id": 138,
      "required": false,
      "operation": "INVOKE_CMD_INTERPRETER",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.docm"
      },
      "id": 139,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.xlsm"
      },
      "id": 140,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.pptm"
      },
      "id": 141,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.docm"
      },
      "id": 142,
      "required": false,
      "operation": "INVOKE_SCRIPT",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.xlsm"
      },
      "id": 143,
      "required": false,
      "operation": "INVOKE_SCRIPT",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.pptm"
      },
      "id": 144,
      "required": false,
      "operation": "INVOKE_SCRIPT",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.docm"
      },
      "id": 145,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.xlsm"
      },
      "id": 146,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**.pptm"
      },
      "id": 147,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "/Applications/My WebBrowser.app/Contents/MacOS/WebBrowser"
      },
      "id": 148,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "/Applications/My WebBrowser.app/Contents/MacOS/WebBrowser"
      },
      "id": 149,
      "required": false,
      "operation": "CODE_INJECTION",
      "action": "DENY"
    },
    {
      "application": {
        "type": "NAME_PATH",
        "value": "**"
      },
      "id": 150,
      "required": false,
      "operation": "RANSOM",
      "action": "TERMINATE"
    }
  ],
  "id": -1
}