Application Control

Application control governs which software is allowed to run or be installed on your hosts. It is managed under Manage → Device & Application Control.

Rules

You define rules that match software and choose what happens when a match occurs:

• Match on name, path or SHA-256 hash.

• Action — deny or alert.

A deny rule stops the matched software; an alert rule records that it matched without stopping it.

Monitor vs enforce mode

• Monitor mode — rules are evaluated and matches are recorded as alerts, but nothing is stopped. Use this to validate your rules against real activity before turning on enforcement.

• Enforce mode — deny rules are acted on, on the host.

How enforcement works: when a denied program runs, the agent terminates the process as it starts. This is kill-on-start enforcement — the matched process is stopped immediately rather than being prevented from ever launching. Validate your rules in monitor mode first so a misconfigured rule doesn't kill legitimate software.

Workflow

1. Add rules matching the software you want to control, by name, path or hash.

2. Run in monitor mode and review the alerts to confirm the rules match what you expect.

3. Switch to enforce mode once you are confident the rules are correct.