Testing Application Control rules

To ensure that Application Control rules do not block applications required for work, it is recommended to enable testing of Application Control rules and analyze their operation after creating new rules.

An analysis of the operation of Application Control rules requires a review of the resultant Application Control events that are reported to Kaspersky Security Center. If test mode results in no blocked startup events for all applications required for the work of the computer user, this means that the correct rules were created. Otherwise, you are advised to update the settings of the rules you have created, create additional rules, or delete the existing rules.

By default, the Apply rules action is selected for Application Control rules.

To enable testing of Application Control rules or to select a blocking action for Application Control:

1. In the main application window, click the Settings button.
2. In the application settings window, select Security Controls → Application Control.
3. Select the Application Control check box to make the component settings available for editing.
4. In the Control mode drop-down list, select one of the following items:
   • Black List, if you want to allow the startup of all applications except the applications specified in block rules.
   • White List, if you want to block the startup of all applications except the applications specified in allow rules.
5. Do one of the following:
   • If you want to enable test mode for Application Control rules, select the Test rules option in the Action drop-down list.
   • If you want to enable blocking mode for Application Control rules, select the Apply rules option in the Action drop-down list.
6. Save your changes.

Kaspersky Endpoint Security will not block applications whose startup is forbidden by the Application Control component, but will send notifications about their startup to the Administration Server.

Page top