Process Rules

The Process node allow security control rules to be matched with specific requesting processes. Process rules allow you to manage access for an application to run child processes which might otherwise be managed differently in other rules. You can add Allowed Items, Denied Items, Trusted Vendors and User Privilege Management to the rule.

For further information, see Rule Items.

You can add files, folders, drives, signature items, network connection items and application groups as managed items into the Allowed Items and Denied Items lists of a process rule.

The Process Rule only manages the first level of child process run by the application, not the children of child processes. The Process does not manage the application. This must be managed by other rules unless the application is managed as a child process in another Process Rule.

Create a Process Rule

The process rule applies to the application that is attempting to start an application, load a component, or access a network resource. The process rule can allow certain applications to run but prohibit it from running when launched by specific processes.

  • Rules are displayed in the order they are created and are not alphabetical.
  • Process rule names must be unique. You cannot create two process rules with the same name.
  • You cannot have duplicate processes.
  • You cannot cut, copy and paste process rules.

  1. From the Rules ribbon, select the Add Rule > Process Rule.

    A process rule is created and consists of four rule items: Allowed Items, Denied Items, Trusted Vendors, and User Privileges.

  2. Right-click the new process rule and select Rename.
  3. Give the rule an intuitive name.

  4. Apply the required security level: Restricted, Audit Only or Unrestricted.

    For more information, see Security Levels.

  5. Add a process to the processrule.
  6. Add an item to a process.

Add a Process to a Process Rule

Use the Process Rule work area to add processes to a process rule. The processes listed within this area are used during rules processing to match the rule to a request's process originator.

The first column displays the name and location of the process file or signatures, the second contains the signature for the process, if applicable, and the third column displays the description of the process, if present.

  1. Select the process rule.

    The Process Rule work area displays.

  2. In the Rules ribbon, select the Add Process drop-down arrow and select to add the required process:

    • File

    • Folder

    • Signature

    • Group

    You can add multiple files at once. You can drag and drop files from Windows Explorer or another file manager, and cut, copy, and paste.

    If there is a process you want to temporarily disable you can toggle the state, to do this select the process, right-click > Change State > Disable/Enable. This saves you from having to remove the process and then re-add it and can be a useful tool for troubleshooting.

    You cannot have duplicate processes.

Add an Allowed or Denied Item to a Process Rule

Allowed Items and Denied Items can contain files, folders, drives, signatures, Windows Store Apps, and network connection items. They can also include groups.

  1. Select the required Process Rule.
  2. Click the Add Item drop-down arrow on the Rule Items ribbon and select either Allowed or Denied.
  3. Then select the type of item you want to add:

    • File

    • Folder

    • Drive

    • Signature Item

    • Network Connection Item

    • Windows Store App

    • Group

    Groups can consist of a number of items. For example, all the File, Folder, Drive, and Signature File items for a particular application.

    If there is an item you want to temporarily disable you can toggle the state, to do this select the item, right-click > Change State > Disable/Enable. This saves you from having to remove the item and then re-add it and can be a useful tool for troubleshooting.

Example: Using a Process Rule to Restrict Access to FTP

You can use process rules to allow, for example, only certain applications to access FTP.

This example shows how to use process rules to allow only a specific application to access FTP ports 20 and 21. The first step is to create a group to specify the

  1. Select the Group Management node.
  2. Select Add Group on the Groups ribbon.
  3. Select and right-click the new group and select Rename.
  4. Rename the group with an intuitive name, for example, Specify FTP Ports.

  5. Select the Add Item drop-down arrow on the Groups ribbon and select Network Connection.

    The Add a Network Connection dialog displays.

  6. Specify the host in the Host field.
  7. Select the Ports button on the right hand-side of the Ports field. The Common Ports dialog displays.
  8. Select ports 20 and 21: FTP - Data Port and FTP - Control port, and click Add.
  9. Select the Text contains wildcard characters option and click Add.
  1. Select the top level Process rule node.
  2. Select the Add Rule drop-down arrow on the Rules ribbon and select Process Rule.
  3. Select and right-click the new process rule and select Rename.
  4. Give the rule an intuitive name, for example, Cannot access FTP.

  5. Right-click within the Processes work area, and select Add > File.

    The Add a File dialog displays.

  6. Enter * in the File field and click Add. This denotes that all files are blocked from accessing ports FTP 20 and 21. The use of
  7. Expand the new process rule node.
  8. Select the Denied Items node.
  9. Select the Add Item drop-down arrow and select Denied > Group. The Group selection for dialog box displays.
  10. Select the group created in the Create a Group procedure and click Add. This rule now prohibits all applications from accessing the FTP ports 20 and 21.
  1. Select the top level Process rule node.
  2. Select the Add Rule drop-down arrow on the Rules ribbon and select Process Rule.
  3. Select and right-click the new process rule and select Rename.
  4. Give the rule an intuitive name, for example, Can access FTP.

  5. In the Processes work area, right-click and select Add > File.

    The Add a File dialog displays.

  6. Browse to and select the file that you want to access FTP, for example, Internet Explorer.
  7. If required, expand the new process rule node.
  8. Select the Allowed Items node.
  9. Select the Add Item drop-down arrow and select Allowed > Group. The Group selection for dialog displayed.
  10. Select the group created in the Create a Group procedure and click OK. This rule now allows the specified application to access the FTP ports 20 and 21.
  1. Expand the Group node and select BUILTIN\Administrators. The Group Rule work area displays.
  2. Drag the Security Level slider to Restricted.

Save the configuration. Only the application specified in the procedure can access FTP ports 20 and 21. All other applications cannot.

Related topics

Allowed Items

Denied Items