> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/application-control.md).

# Application Control

Application control governs which software is allowed to run or be installed on your hosts. It is managed under **Manage → Device & Application Control**.

## Rules

You define rules that match software and choose what happens when a match occurs:

* **Match on** name, path or SHA-256 hash.
* **Action** — `deny` or `alert`.

A `deny` rule stops the matched software; an `alert` rule records that it matched without stopping it.

## Monitor vs enforce mode

* **Monitor mode** — rules are evaluated and matches are recorded as alerts, but nothing is stopped. Use this to validate your rules against real activity before turning on enforcement.
* **Enforce mode** — `deny` rules are acted on, on the host.

{% hint style="info" %}
**How enforcement works:** when a denied program runs, the agent terminates the process as it starts. This is kill-on-start enforcement — the matched process is stopped immediately rather than being prevented from ever launching. Validate your rules in monitor mode first so a misconfigured rule doesn't kill legitimate software.
{% endhint %}

## Workflow

1. Add rules matching the software you want to control, by name, path or hash.
2. Run in **monitor mode** and review the alerts to confirm the rules match what you expect.
3. Switch to **enforce mode** once you are confident the rules are correct.