Within Harmony Endpoint there are two alternative mechanisms for application control
- App Rules: Configuration based on the Applications that were uploaded within the Appscan XML file
- Custom Rules: Flexible sets of custom rules that are defined by the administrator
In recent Windows endpoint releases the following enhancements were made for Custom Rules
- Wildcards can be specified in rules. For example can define all versions of a specific application rather than multiple rules each based on a specific hash
- Rules can be defined based on values in certificates. For example all application signed by certificate with specific name
- Application whitelisting. Allows the default action to be defined “Terminate”. This capability effectively enables “Application Whitelisting” where can specify all the applications that are allowed to run and then ensure that all others are terminated. Note that processes associated with O/S and Harmony Endpoint are implicitly defined and allowed to run and do not need to be defined in the configuration
Application whitelisting is available in E87.60 as EA (Early Availability) functionality. Moving forward custom rules are recommended for customers new to application control and can also be assessed for customers with existing configuration using app rules to replace these definitions
If there is anyone who wants to assess the full capabilities of the custom rules, and also use for whitelisting with latest enhancements, please reach out to me directly and can assess enabling the EA functionality
Also feel free to contact me if looking for additional details on application control
