Testing Application Control rules

To ensure that Application Control rules do not block applications required for work, it is recommended to enable testing of Application Control rules and analyze their operation after creating new rules.

An analysis of the operation of Application Control rules requires a review of the resultant Application Control events that are reported to Kaspersky Security Center. If test mode results in no blocked startup events for all applications required for the work of the computer user, this means that the correct rules were created. Otherwise, you are advised to update the settings of the rules you have created, create additional rules, or delete the existing rules.

Test mode for Application Control rules is disabled by default.

To enable testing of Application Control rules or to select a blocking action for Application Control:

  1. Open the application settings window.
  2. In the left part of the window, in the Security Controls section, select the Application Control subsection.

    In the right part of the window, the settings of the Application Control component are displayed.

  3. Select the Enable Application Control check box to make the component settings available for editing.
  4. In the Application Control mode drop-down list, select one of the following items:

    Black List, if you want to allow the startup of all applications except the applications specified in block rules.

    • White List, if you want to block the startup of all applications except the applications specified in allow rules.
  5. Do one of the following:
    • If you want to enable test mode for Application Control rules, select the Notify option in the Action drop-down list.
    • If you want to enable blocking mode for Application Control rules, select the Block option in the Action drop-down list.
  6. To save changes, click the Save button.

Kaspersky Endpoint Security will not block applications whose startup is forbidden by the Application Control component, but will send notifications about their startup to the Administration Server.

Page top