Application Control

This page refers to an older version of the product.
View the current version of the online Help.

Process Rules

The Process node allow security control rules to be matched with specific requesting processes. Process rules allow you to manage access for an application to run child processes which might otherwise be managed differently in other rules. You can add Allowed Items, Denied Items, Trusted Vendors and User Privilege Management to the rule.

For further information, see Rule Items.

You can add files, folders, drives, signature items, network connection items and application groups as managed items into the Allowed Items and Denied Items lists of a process rule.

The Process Rule only manages the first level of child process run by the application, not the children of child processes. The Process does not manage the application. This must be managed by other rules unless the application is managed as a child process in another Process Rule.

Create a Process Rule

The process rule applies to the application that is attempting to start an application, load a component, or access a network resource. The process rule can allow certain applications to run but prohibit it from running when launched by specific processes.

• Rules are displayed in the order they are created and are not alphabetical.
• Process rule names must be unique. You cannot create two process rules with the same name.
• You cannot have duplicate processes.
• You cannot cut, copy and paste process rules.

1. From the Rules ribbon, select the Add Rule > Process Rule.

   A process rule is created and consists of four rule items: Allowed Items, Denied Items, Trusted Vendors, and User Privileges.

2. Right-click the new process rule and select Rename.
3. Give the rule an intuitive name.

4. Apply the required security level: Restricted, Audit Only or Unrestricted.

   For more information, see Security Levels.

5. Add a process to the rule.
6. Add an item to a rule item.

Add a Process to a Process Rule

Use the Process Rule work area to add processes to a process rule. The processes listed within this area are used during rules processing to match the rule to a request's process originator.

The first column displays the name and location of the process file or signatures, the second contains the signature for the process, if applicable, and the third column displays the description of the process, if present.

1. Select the process rule.

   The Process Rule work area is displayed.

2. In the Rules ribbon, select the Add Process drop-down arrow and do one of the following:
   • To add a file, select Add > File

   • To add a signature, select Add > Signature

   You can add multiple files at once. You can drag and drop files from Windows Explorer or another file manager, and cut, copy, and paste.

   You cannot have duplicate processes.

3. Use the Rescan Signature button on the Rules ribbon to

Add an Allowed or Denied Item to a Process Rule

Allowed Items and Denied Items can contain files, folders, drives, signatures, Windows Store Apps, and network connection items. They can also include groups.

1. Select the required Allowed or Denied Item.
2. Click the Add Item drop-down arrow on the Rule Items ribbon and select either Allowed or Denied.
3. Once you have selected the item type to add to the process rule, do one or more of the following:
   • To add a file, select Add > File
   • To add a folder, select Add > Folder
   • To add a drive, select Add > Drive
   • To add a signature item, select  Add > Signature Item
   • To Add a Network Connection item, select  Add > Network Connection Item
   • To Add a Windows Store App, select Add > Windows Store App
   • To add a group, select Add > Group
4. Groups can consist of a number of items. For example, all the File, Folder, Drive, and Signature File items for a particular application.

Example: Using a Process Rule to Restrict Access to FTP

You can use process rules to allow, for example, only certain applications to access FTP.

This example shows how to use process rules to allow only a specific application to access FTP ports 20 and 21. The first step is to create a group to specify the