App Control Overview

The App Control Overview page displays charts for you to gain an overall insight in to the App Control performance. You can use this data to build and fine tune your configuration rules.

The charts on the overview page will, by default, show event data from your entire estate. Additionally, you can select a specific configuration using the drop-down in the top right corner. Selecting a configuration, filters all the data shown in the charts to events that were raised by devices which have the selected configuration applied. Allow one day to pass for App Control to gather enough data to show in the charts. Event data is processed between 8 pm and 4pm, but charts will not reflect this data until after 5am when aggregations used by the charts are recalculated. Click into any chart to drill down for further detail.

App Control displays warnings to remove older events when it reaches 80% or maximum capacity to accommodate new events. App Control retains event data for a maximum of 7 days or up to 10 million events, or whichever comes first. Once either threshold is exceeded, App Control will continue to process new events, but will automatically purge older events until the total number of stored events falls below the specified limit.
To ensure effective event management and prevent recurring alerts, administrators must identify the root cause of the events and adjust the application configuration accordingly. For step-by-step guidance, refer to App Control Rules.
Use the Product Performance charts on the App Control Overview page to identify and address the events that are generating alerts. Event alerts are generated and assessed daily. These alerts cannot be dismissed manually; they will be automatically cleared once event counts drop below the specified threshold. After new rules are created, please note that it may take up to 24 hours or longer for the alert to be dismissed.

The page has three sections:

Applications Executed

This charts section contains the following:

Applications executed with untrusted owners (top 5)

The chart shows the top 5 applications that have been executed whose file owner is not trusted and has been, or would have been, blocked by App Control's Trusted Ownership. Use the drop-down selector to change the chart data from Applications to All files, and the time range drop-down selector to change the time period of the application capture, select from the last day (from 00:00 previous day), 3 days, and 7 days. Click on the chart to drill down to see the top 20 applications and more granular detail. The Applications executed with untrusted owners page appears. The file is listed, together with the number of executions and the number of users attempting execution. If you have changed the time period it persists through the drill down.

On the Applications executed with untrusted owners page, you have the following actions:

  • Create Rule: Select the files for which you want to create an Allow Rule. Click Actions > Create Rule. Follow the steps in Create an Allow Rule for any of the files that have been executed without trusted ownership.
  • Hide: Select an item to hide from the results. Click Actions > Hide. You may want to hide files/applications from the list that you have already included in a rule.
  • Unhide: Select the Show Hidden Files/Applications check box, the Hidden column displays in the table and all hidden files/applications are shown. Select the items you want to unhide, click Actions > Unhide.
  • File Name drill-down: Click on a File Name to see further file details, such as information to identify which users executed the file, together with the file owner and file path, last execution date and time, and the number of executions.
    Select the files for which you want to create an Allow Rule. Click Actions > Create Rule. Follow the steps in Create an Allow Rule for any of the files that have been executed without trusted ownership.
  • File Name expand: Click the right arrow iconicon next to a file to expand the file information to see the product versions, parent processes, file paths, product and company names, number of users and number of executions.
    Select the Parent Processes for which you want to create an Allow Rule. Click Actions > Create Rule. Follow the steps in Create an Allow Rule for any of the files that have been executed without trusted ownership.. The selected Parent Process is populated in the When stage of the rule creation.

  1. Select the files for which you want to create a rule. Click Actions > Create Rule.
    The Create rule options panel appears.
  2. In the Create rule options panel, select the data that you want to use as the rule criteria. The options available will depend on the level of drill-down from which you are accessing the Rule item options dialog. The options selected will be used to populate the Rule Item Settings.
    • Property options:
      • Use full File Path
    • Metadata options:
      • Vendor
      • Product Version
      • Product Name
      • Company Name
    • When Source options:
      • App Control User
      • Device
      • Parent Process
    • Configuration: Select the configuration from the drop-down that you want to assign the rule to. The configuration must have the most up-to-date schema, if the schema is out-of-date you have the option to go to the configuration to perform the update.
  3. Click Create.
    The Configuration Allow Rule - What do you want to allow? page appears.
  4. For instructions on how to create an Allow Rule, refer to Allow/Deny Rule.

Applications executed with elevated privileges (top 5)

The chart shows the top 5 applications that have been elevated via the Windows Run as Administrator option. Use the drop-down selector to change the time period of the application capture, select from the last day (from 00:00 previous day), 3 days, and 7 days. Click on the chart to drill down to see the top 20 applications and more granular detail. The Applications executed with elevated privileges page appears. The file is listed, together with the number of executions and the number of users attempting execution. If you have changed the time period it persists through the drill down.

On the Applications executed with elevated privileges page, you have the following actions:

  • File Name drill-down: Click on a File Name to see further file details, such as information to identify which users executed the file, together with the file owner and file path, last execution date and time, and the number of executions.
    Select the files for which you want to create an Elevate Rule. Click Actions > Create Rule. Follow the steps in Create an Elevate Rule for any of the items that have been executed with elevated privileges.
  • File Name expand: Click the right arrow iconicon next to a file to expand the file information to see the product versions, parent processes, file paths, product and company names, number of users and number of executions.
    Select the Parent Processes for which you want to create an Elevate Rule. Click Actions > Create Rule. Follow the steps in Create an Elevate Rule for any of the items that have been executed with elevated privileges.. The selected Parent Process is populated in the When stage of the rule creation.
  1. Select the files for which you want to create a rule. Click Actions > Create Rule.
    The Create rule options panel appears.
  2. In the Create rule options panel, select the data that you want to use as the rule criteria. The options available will depend on the level of drill-down from which you are accessing the Rule item options dialog. The options selected will be used to populate the Rule Item Settings.
    • Property options:
      • Use full File Path
    • Metadata options:
      • Vendor
      • Product Version
      • Product Name
      • Company Name
    • When Source options:
      • App Control User
      • Device
      • Parent Process
    • Configuration: Select the configuration from the drop-down that you want to assign the rule to. The configuration must have the most up-to-date schema, if the schema is out-of-date you have the option to go to the configuration to perform the update.
  3. Click Create Rule.
    The Configuration Elevate Rule - What do you want to elevate? page appears.
  4. For instructions on how to create an Elevate Rule, refer to Elevate Rule.

Deployment indicator

The Deployment indicator displays the total number of devices that have been discovered by Ivanti Neurons and the number of those that have an Ivanti Neurons agent installed, with an Agent Policy which has the App Control Capability enabled, and an App Control configuration successfully deployed.

Click on the progress bar to display the Deployment page.

Deployment page

The Deployment page lists all discovered devices, with details of the Device Name, Display Name, IP Address, OS and version, whether the App Control capability is enabled, and the assigned Policy.

If the column Has App Control capability shows a red cross , it means that the device does not have a policy with the App Control capability enabled.

Go to Agents > Agent Policies to create or select a policy and select the App Control capability.
To enable the capability you need to have an App Control configuration ready to assign to the policy. This configuration can be edited at a later date if needs be.

The device receives the new/updated policy when it next checks in. The Has App Control capability column should then show a green tick .

  1. Click on the Deployment indicator status bar.
    The Deployment page appears.
  2. Click on a Device Name.
    The Devices > Device Overview page appears.

Learn more about Device details.

  1. Click on the Deployment indicator status bar.
    The Deployment page appears.
  2. Click on a Policy Name.
    The Agents > Agent Policies > Agent Policy > Capabilities page appears.

Learn more about Agent Policy Capabilities.

Product Performance

The Product Performance charts provide an insight into your users application behavior. Click anywhere on a chart to drill-down to see user information and more granular detail. The following charts are available:

Denied executions over time

This chart shows the number of application executions that have been denied when running App Control with the security level Restricted. The results are based on either trusted ownership or configuration deny rules, for the selected period of time. The default is to show daily denials over the last 30 days, you can customize the time period to the last 7 days, or monthly over the last 3 or 6 months.

Denied Executions by vendor

This chart shows the number of application executions by vendor that have been denied over the last 30 days, either based on trusted ownership or configuration deny rules.

Privilege Elevations over time

This chart shows the number of application executions that have been elevated by App Control, based on the configuration elevate rules, for the selected period of time. The default is to show daily elevations over the last 30 days, you can customize the time period to the last 7 days, or monthly over the last 3 or 6 months.

Self-elevations over time

This chart shows the number of application executions that have been elevated based on the configuration self-elevate rules, for the selected period of time. The default is to show daily elevations over the last 30 days, you can customize the time period to the last 7 days, or monthly over the last 3 or 6 months.

Allowed applications via Policy Change Request over time

This chart shows how often the allowed applications are run or used over a certain time period. By default, this shows the allowed applications over the last 30 days. You can customize the time period to the last 7 days, or monthly over the last 3 or 6 months.

Elevated applications via Policy Change Request over time

This chart shows how often the applications with elevated permissions are run or used over a certain time period. By default, this shows the elevated applications over last 30 days. You can customize the time period to the last 7 days, or monthly over the last 3 or 6 months.

Application granted by Policy Change Request

This chart shows the number of application granted permissions using Policy Change Request over the past 30 days. You can click the chart to view detailed reports about the application, its run time, elevations, and more.