A courts e-filing desktop app is terminated by Carbon Black Cloud. SOC confirms the policy’s core prevention is working as designed against unknown binaries. What should the security administrator do?

When a courts e-filing desktop app is terminated by Carbon Black Cloud and SOC confirms the policy's core prevention is working as designed against unknown binaries, add a scoped permission for the known e-filing application in the courts sensor policy. Prevention doing its job against unknowns should not be disabled; a narrow permission for the vetted civic e-filing binary restores clerk workflow under least privilege. Uninstalling the sensor from the clerk workstations so the app can run fails by concept because removing prevention abandons endpoint protection across the courts estate. Setting the entire courts OU to bypass mode until the next fiscal year fails by concept because broad bypass disables prevention for far more than one known application. Creating an NSX-T any-any DFW rule so the app can reach the filing backend fails by concept because network any-any does not stop CBC from terminating a local unknown binary and expands network blast radius. Exam caveat: when prevention works as designed, scope a permission for the known app—do not uninstall sensors, set OU-wide bypass, or use NSX any-any as the app allow. Operational check: add a scoped CBC permission for the e-filing hash/path in the courts policy, confirm clerks can file, keep core prevention on, and record the exception with business justification in the court security change log for municipal justice governance.