Custon rules aplication control ?

[lluner]

Has anyone tested the custom rules in the application control? Honestly, I've tested everything and the custom rules don't work; only the rules defined in "app rules" work. For example: I want to create a rule that blocks all versions of Firefox.

[Chris_Atkinson]

Can you please clarify what you define as being a "custom rule" and more specifically if this is being tested with / without HTTPS inspection and with what gateway version & JHF etc?

/Edit: Noted this is an Endpoint query.

[lluner]

@Chris_Atkinson 

These custom rules don't work; only the app rules work. See the images below.

[the_rock]

Hey brother,

Mind sending a screenshot as an example of what you tested?

[Don_Paterson]

EDIT:

My reply  below is about the Check Point Security Gateway capabilities and not Harmony Endpoint App Control capabilities.

I wonder if AppScan could help here.

-------------------------

Works for me

R82

No https inspection

New connection - first time Firefox is used - no caching

Firefox browser is blocked.

[the_rock]

I actually tried same in my lab Don and it also blocked incognito window, so definitely works. But, I have a feeling @lluner was referring to endpoint policy, just my impression based on what was posted.

[Don_Paterson]

Ah, ooops. I didn't spot that it in the Endpoint forum. 

Thanks for that.

[lluner]

@the_rock 

The issue is that the blocking occurs at the harmony endpoint, not at the gateway checkpoint.

[the_rock]

Thats what I figured based on your screenshots. Did you open TAC case yet?

[lluner]

@the_rock 

I'm first trying to see if anyone can configure these settings and provide an example.

[the_rock]

Let me ask one of my colleagues, have a call with him in few mins, he is very good with endpoint. Will update you after.

[lluner]

@Don_Paterson 

I've already tried using AppScan, and it works. The problem is that you need to create a custom rule for multiple versions of Adobe, Firefox, or 7-Zip. Using AppScan becomes impractical.

[the_rock]

This is what my colleague showed me, not sure if you tried it or not.

 

 

[lluner]

@the_rock 

I've tried everything to block Adobe and other applications, but nothing works.

[the_rock]

So regardless of which application you try, same result?

[lluner]

@the_rock 

Yes, I've tried everything. I tried following the manual exactly, but it doesn't work. It only works when I use AppScan, import the file, and then block it. 

Configuring Application Permissions in the Application Control Policy

It only works by uploading the AppScan XML file. The "custom rules" option doesn't work at all.

Below are the application control logs using the AppScan XML file.

[the_rock]

I would definitely open TAC case and reference this post.

[lluner]

@the_rock 

That's what I'm going to do; I've already opened a ticket with a partner. I'll keep you updated here.

[the_rock]

I will check with my colleague again, but I can tell by the things you post and try about harmony endpoint, that you are very FAMILIAR with it, so I trust all you did. Please keep us posted.

Excellent work, as always.

[RS_Daniel]

Hello,

We usually block apps using the field  Issued To, and that blocks all versiones of the app. You can check on a couple diferent versions of firefox to check if the cert matchs just to double check. In some tests, we saw that the "Application Name" field is actually the name of the process running on windows, so for adobe i think you can use "Acrobat.exe" on your rule. Attaching an example to block opera. HTH.

[the_rock]

Hey Daniel,

Just for my own knowledge, what is the key field in custom rule for it to work? 

[lluner]

@RS_Daniel 

I've already tested all of that. I only see one thing: the endpoint version. What version are you using?

[the_rock]

So no change regardless of what app is used?

[RS_Daniel · Accepted solution]

Hi,

Just tested with field Issued to and worked fine, attaching the test rule i used. Version E89.05.

[the_rock]

I wonder if that field has to be 100% correct, since I just tried Mozilla, without corporation, but no joy.

[lluner]

@RS_Daniel  

It worked. Thanks for the help.

[the_rock]

Excellent!