Issue:
The Application Control rule "Block rare and unknown files in Temp folder" or "Block rare and unknown files in Downloads folder" in the Elements Endpoint Protection client (Elements EPP for Computers or Elements EPP for Servers) block an application from running.
How can we create an Application Control exclusion to allow the application to run?
Resolution:
The Application Control exclusion can be created using several different conditions. To view the details of the application or file which was blocked:
- Log in to the Elements Security Center
- Navigate to Events > Security Events
- Click the arrow on the left of the corresponding security event to view the details.
From here, you can easily copy details such as the Target Product Name, Target Signature Signer Name, etc., of the blocked file.
Once you have the details of the blocked file, you can create an Application Control exclusion.
- Navigate to Security Configurations > Profiles.
- Select the profile that you want to edit.
- Go to the Application Control settings.
- Click Add a new top rule
- Select Application start and module load from the Event drop-down menu and Allow from the Action drop-down menu.
- Define the condition(s) accordingly, such as:
- Target signer name > is equal to > Target signature signer name (copied from the corresponding security event details), or
- Target Path > is equal to > Target path (copied from the corresponding security event details), etc.
- Click Save and publish
In step 6, you can also use any other condition that suits your needs. You do not have to use the Target signer name, or Target Path. Target product name, Target company, etc. are other conditions that could be used in this situation. All of these can be found from the block detection on the Security Events page.
Additionally, ensure that the newly created whitelisting rule is moved to the top, so it stays above the blocking rule. Application Control processes rules from top to bottom.
If necessary, you can refer to the product help guide for more information.
https://www.withsecure.com/userguides/product.html#business/psb-portal/latest/en/task_D5DDA11EBAE543F0977322A363DE879D-psb-portal-latest-en
Article no: 000027741