Process Rules

The Process node allow security control rules to be matched with specific requesting processes. Process rules allow you to manage access for an application to run child processes which might otherwise be managed differently in other rules. You can add Allowed Items, Denied Items, Trusted Vendors and User Privilege Management to the rule.

You can add files, folders, drives, signature items, network connection items and application groups as managed items into the Allowed Items and Denied Items lists of a process rule.

The Process Rule only manages the first level of child process run by the application, not the children of child processes. The Process does not manage the application. This must be managed by other rules unless the application is managed as a child process in another Process Rule.

Create a Process Rule

The process rule applies to the application that is attempting to start an application, load a component, or access a network resource. The process rule can allow certain applications to run but prohibit it from running when launched by specific processes.

  • Rules are displayed in the order they are created and are not alphabetical.
  • Process rule names must be unique. You cannot create two process rules with the same name.
  • You cannot have duplicate processes.
  • You cannot cut, copy and paste process rules.
  1. From the Rules ribbon, select the Add Rule > Process Rule.

    A process rule is created and consists of four rule items: Allowed Items, Denied Items, Trusted Vendors, and User Privileges.

  2. Right-click the new process rule and select Rename.
  3. Give the rule an intuitive name.
  4. Apply the required security level: Restricted, Audit Only or Unrestricted.

  5. Add a process to the processrule.
  6. Add an item to a process.

Add a Process to a Process Rule

Use the Process Rule work area to add processes to a process rule. The processes listed within this area are used during rules processing to match the rule to a request's process originator.

The first column displays the name and location of the process file or signatures, the second contains the signature for the process, if applicable, and the third column displays the description of the process, if present.

  1. Select the process rule.

    The Process Rule work area displays.

  2. In the Rules ribbon, select the Add Process drop-down arrow and select to add the required process:
    • File

    • Folder

    • Signature

    • Group

    You can add multiple files at once. You can drag and drop files from Windows Explorer or another file manager, and cut, copy, and paste.

    If there is a process you want to temporarily disable you can toggle the state, to do this select the process, right-click > Change State > Disable/Enable. This saves you from having to remove the process and then re-add it and can be a useful tool for troubleshooting.

    You cannot have duplicate processes.

Add an Allowed or Denied Item to a Process Rule

Allowed Items and Denied Items can contain files, folders, drives, signatures, Windows Store Apps, and network connection items. They can also include groups.

  1. Select the required Process Rule.
  2. Click the Add Item drop-down arrow on the Rule Items ribbon and select either Allowed or Denied.
  3. Then select the type of item you want to add:
    • File

    • Folder

    • Drive

    • Signature Item

    • Network Connection Item

    • Windows Store App

    • Group

    Groups can consist of a number of items. For example, all the File, Folder, Drive, and Signature File items for a particular application.

    If there is an item you want to temporarily disable you can toggle the state, to do this select the item, right-click > Change State > Disable/Enable. This saves you from having to remove the item and then re-add it and can be a useful tool for troubleshooting.

Example: Using a Process Rule to Restrict Access to FTP

You can use process rules to allow, for example, only certain applications to access FTP.

This example shows how to use process rules to allow only a specific application to access FTP ports 20 and 21. The first step is to create a group to specify the

Related topics

Allowed Items

Denied Items