Application Allow List

Applications can be allow listed to stop captures from being generated within the application.

Navigate to the Settings View and click on Applications.

Open

Click Add to create a new list.

Open

Give the list a name and description if necessary. Single click the new list to highlight it and click Settings to view the list.

Add an Application to the allow list

Click on Add to add a new application entry.

Several options will be available.

• App Name

  • The name of the application.

• App Filename

  • The filename of the application, i.e. CHROME.EXE

• Blocked

  • This setting will force a capture every time the application is accessed. It does not stop the application from being opened.

• Allowed

  • Select whether you want the application to be allowed, stopping application captures from being generated.

• Type

  • Allows you to categorise the application, this will show against the capture and can be searched for to group captures together.

In the Advanced section you can also find the following options:

• App Path

  • The path to the application. Useful for wildcarding an entire folder but not necessary to fill out for each application.

• Confidence

  • This will modify the client’s behaviour by only allowing captures through that hit a set confidence rating. For example, setting a rating of 90 will only allow captures to be generated if the confidence score is 90+. This can help reduce false positives from certain applications. This will not work if the application has been whitelisted or blacklisted.

• Weighting

  • Allows you to change the severity weighting for certain applications. For example, a value of -1 will reduce all severities from the website by 1. This will not work if the application has been whitelisted or blacklisted.

Newly created Application lists will be automatically assigned to the group or level they are created at.

Application lists can also be assigned to other groups after being created.

Start by clicking on the level or group you wish to assign to and click on Settings, then Monitoring.

Click Edit, scroll to the bottom and under App Groups, select the application list from the drop down menu.

Ensure App Whitelisting or Blacklisting is enabled and then click Save to finish.

Document number/reference: SEC-KB-SETUP-002

Classification Level: Public

Related Labels: