Knowledge Base

CBFS Filter 2022 API Changes ... release of CBFS Filter 2022 includes several API changes that may require code changes. The table below is a list of major changes between CBFS Filter 2020 and CBFS Filter 2022. Upgrading to CBFS Filter ... Tracking Process Creation with CBFS Filter ... Summary CBProcess is a component of CBFS Filter, an SDK and library designed for monitoring and controlling various system activities, including the lifecycle of processes and threads, f ... Access and Default Rules in CBFS Filter ... CBFS Filter supports three types of rules for processing filesystem requests: Standard Filter Rules: These rules fire corresponding events in the user mode, which involves context ... Overview of Process Monitoring with CBFS Filter ... Summary CBProcess is a component of CBFS Filter, an SDK and library designed for monitoring and controlling various system activities, including the lifecycle of processes and threads, f ... Overview of Registry Monitoring with CBFS Filter ... Summary CBRegistry is a component of CBFS Filter, an SDK and library designed for monitoring and controlling various system activities, including registry operations, filesystem operatio ... Redirection of File Access with CBFS Filter ... CBFilter is a component of CBFS Filter, an SDK and library designed to control various system activities, including filesystem operations. This component—available as a class, struct, or ... Implementing Virtual Files with CBFS Filter ... methods here filter.OnBeforeCreateFile += HandleBeforeCreateFile; filter.OnBeforeOpenFile += HandleBeforeOpenFile; filter.OnBeforeQueryFileInfo += HandleBeforeQueryFileInfo; filter.OnBeforeSetFileInfo ... Building a Ransomware Honeypot with CBFS Filter ... through its virtual file mechanism, described in general terms in Implementing Virtual Files with CBFS Filter. This article applies that mechanism specifically to deception-based detecti ... Protecting Files and Folders with CBFS Filter ... threats, and maintain a comprehensive audit trail for sensitive data. CBFilter is a component of CBFS Filter, an SDK and library designed for monitoring and controlling various system ac ... Hiding Files and Folders with CBFS Filter ... reaching the filesystem. If you need to exclude certain entries from filtering, you can define pass-through rules that negate the effects of filter rules. This is done using the AddPasst ... Direct File Access with CBFS Filter ... the following call: filter.CreateFileDirect("file.txt", true,...) However, calling filter.CreateFileDirect("anotherfile.txt", true,...) or filter.CreateFileDirect ... Processing File Changes with CBFS Filter ... One of the frequent tasks for filesystem filter drivers is to detect a change in file data and to process new data. Two approaches can be followed to deal with this task: (1) reacting to each c ... What's New in CBFS Filter 2020 ... details about how to upgrade existing code to CBFS Filter 2020 from CBFS Filter 2017, CBFS Registry 2017, and/or CBFS Process 2017. Please refer to the CBFS Filter ... Backing Up File Data with CBFS Filter ... after starting the filter with StartFilter, but you must start it to receive the events. Additionally, you need to enable the AllowFileAccessInBeforeOpen configuration setting: filter.Config ... File Integrity Monitoring for Compliance with CBFS Filter ... and Controlling Access to Network Resources with CBFS Filter and the identity-focused examples in Restricting File Access by User or Group with CBFS Filter. Getting Started ... Blocking Data Exfiltration to USB Drives with CBFS Filter ... pair this check with GetOriginatorToken (covered in Restricting File Access by User or Group with CBFS Filter) or with code-signature verification on the originator's executable path, ra ... Restricting File Access by User or Group with CBFS Filter ... application's startup logic; see Access and Default Rules in CBFS Filter for how AddDefaultRule differs from the standard, application-scoped filter rules used in the example here ... Tracking and Controlling Access to Network Resources with CBFS Filter ... drive letter when the rule is sent to the driver (this happens when filtering is initiated or when the rule is added to the active filter). If path translation fails, the application wil ... Secure File Deletion (Data Shredding) with CBFS Filter ... Catching the Delete Request Add a filter rule with the FS_CE_BEFORE_DELETE flag for the files or directories you need to shred rather than merely delete: filter.AddFilterRule(@"C:\S ... Is there any integrity check to validate which process is using CBFS Filter? ... By default, the CBFS Filter system drivers will accept any valid request from any process. For the CBFilter driver in version 2024, it is possible to specify the list of processes that m ... Tracking and Controlling Network Access to Local Files with CBFS Filter ... BeforeCreateFile and BeforeOpenFile events. To add a rule for these events, use the following call: filter.AddFilterRule("C:\\path\\to\\directory\\*.*", Constants.ACCESS_NONE, Constan ... Why doesn't my application receive events for mapped network drives? ... Due to the way that Windows works internally, CBFS Filter can only intercept filesystem requests that originate on the local machine (since the CBFS Filter system driver mu ... How can I monitor the files in a directory, but not its subdirectories? ... CBFS Filter supports passthrough rules to make tasks like this one possible. Passthrough rules instruct CBFS Filter that it should not intercept requests made against match ... How can I use CBProcess to prevent a process from being started? ... To prevent a process from being started with the CBFS Filter product's CBProcess component, implement the ProcessCreation and do the following: validate the new process using the informa ... A Commercial Alternative to Sysmon You Can Build Into Your Application ... capturing everything and filtering downstream, which matters because CBFS Filter's driver sees every matching request in real time rather than batching to a log. What CBFS Filter ... Why are On*CloseFile events fired long after the file is actually closed? ... mapping. In this scenario, the file will remain open, although all of the handles have been closed. CBFS Filter has no control over the file's lifetime. We appreciate your feedback. If y ... How do I protect my process or thread from being suspended/paused or terminated? ... The CBFS Filter toolkit's CBProcess component provides two events called ProcessHandleOperation and ThreadHandleOperation, which fire anytime some (other) process opens a handle to a pro ... What's New in Version 2026 ... libraries: PCAP Filter CBFS Encrypt In addition, a wide range of improvements have been made to our existing products, including: CBFS Connect CBFS Filter CBFS Vault CBFS Shell PCAP Filter PCAP Filter ... Version 2024 Updates ... which may help while upgrading your project. Contents CBFS Connect CBFS Filter CBFS Shell CBFS Sync Upgrade Guide (API Changes) CBFS Connect CBFS Conne ... Supporting an ISO/IEC 27001 ISMS with ... information. CBFS Encrypt provides transparent, on-the-fly file encryption (AES-256 with PBKDF2 key derivation) that an application can use without building its own cryptographic layer. CBFS ... Product Comparison ... feature sets. More detailed information is available on each product's page. CBFS Connect CBFS Sync CBFS Vault CBFS Filter CBFS Shell Intended Use Cases Use C ... I need to monitor file operations on a server. Is this possible with CBFS ... understand the limitations of Windows' filesystem filtering mechanisms in order to maintain reasonable expectations when developing for such use-cases. The CBFS Filter system driv ... Building HIPAA-Aligned Applications with ... figure if that number matters to your risk assessment. Access Control and Audit Trails: CBFS Filter CBFS Filter intercepts filesystem activity before, or as, it reaches dis ... Version 2024 Upgrade Guide ... capitalization. For instance Cbfs has been renamed to CBFS. Java Component class names have been renamed to use a standard capitalization. For instance Cbfs has been renamed to CBFS ... Building GDPR-Aligned Applications with ... a spot where CBFS Connect and CBFS Cloud have a real structural advantage. Both are SDKs, not a fixed hosted service, so the developer chooses exactly where the underlying data sits. CBFS ... Creating a Replacement for FileSystemWatcher ... of using CBFS Filter for change tracking. This article provides practical guidance for creating a more reliable alternative to FileSystemWatcher using either CBMonitor or CBFilter. CBFS Filter ... Improving Speed of Scanning Files Before Opening ... are not kept in a linear list, do not expect the order in which filter and passthrough rules are added to affect processing. First, all filter rules are evaluated. If a file or directory ... How do I collect a log of file operations on the drive for debugging purposes? ... you may encounter a third-party application that fails to operate correctly when interacting with a CBFS Connect virtual drive. In such cases, it is important to see which filesystem requests s ... Building OneDrive-Style File Sync Into Your Own Application ... model, or a development pattern. CBSync, the component at the core of CBFS Sync, is one API over all three. It builds on Cloud Filter API on Windows, File Provider on macOS, and FUSE on ... Replacing Npcap with PCAP Filter in Wireshark ... Introduction PCAP Filter is a cross-platform packet-capture library that lets developers monitor and filter network traffic in real time without writing low-level driver code. One of PCAP Filter's ... PCAP Filter vs. libpcap, WinPcap, and Npcap ... yourself. What Each One Is libpcap defines the capture semantics, including the BPF filter syntax most packet-filtering tools still use. It doesn't do anything on Windows by itself. WinP ... How can I attach the filter to a USB drive? ... If the filter driver is installed on the system, it will automatically attach itself the BeforeFilterAttachToVolume event handler instructs it to skip the drive. That said, if you use drive-spe ... How do I prevent file deletion using filter rules? ... when the DeleteOnClose flag is initially set) but not be deleted. In this case, you need to add a filter rule that includes the FS_CE_BEFORE_CAN_DELETE flag, and then handle the BeforeOpenFile ... Choosing a File Format for Bundling Encrypted Application Data ... overselling any specific alternative on a technical point that doesn't hold up. What CBFS Vault Actually Adds Where CBFS Vault's CBVault component earns its place isn't "doesn't req ... Is CBFS Vault FIPS Certified? ... The primary purpose of CBFS Vault is to store data in a convenient manner, so it itself is not FIPS certified. However, CBFS Vault does allow you to provide custom encryption procedures ... Compare CBFS and FUSE Components ... Introduction The CBFS component provides a way to create and manage virtual filesystems in your Windows application. CBFS includes advanced functionality for Windows-specific features. I ... CBFS Vault vs. ZIP ... CBFS Vault is a filesystem first and foremost, a solution for storing and organizing named blocks of information. ZIP is a file format for storing various data in compressed form. Feature CBFS ... Getting Started with the CBFS Component ... The CBFS system driver must be installed on a machine before the CBFS component can be used to create and manage virtual drives. This is done using the Install method, which is present in the CBFS ... CBFS Connect 2026 API Changes ... process. However, the release of CBFS Connect 2026 includes several API changes that may require code changes. The table below lists the changes between CBFS Connect 2024 and CBFS ...