Approval request management streamlines the approval process for denial events in the ePO - On-prem console. It allows you to efficiently manage and monitor approval workflows.
Denial events requested for approval from the Application and Change Control Events dialog box are now tagged with Approval Request and sent to the Policy Discovery page on the ePO - On-prem console by default. If sending requests to the Policy Discovery page fails due to the unavailability of file information or unsupported event IDs, they are sent to the pre-configured email server. A notification in the Application and Change Control Events dialog box indicates whether the approval request is sent to ePO - On-prem or the email server. With this enhancement in approval request management, a new Approval Request column is introduced on the Policy Discovery and Queries and Reports pages. The Approval Request tag groups Policy Discovery requests along with the checksum and MP violation flag. Actions for Policy Discovery requests remain unchanged. Sending denial event requests to the Policy Discovery page applies only to specific events such as write denial, execution denial, package modification prevented, NX violation, process hijacked, and network path. All other event requests are sent through the email server.
Here are the different approval request notifications you can see in the "Application and Change Control Events" dialog box:
Submitting an exception request for administrator review and approval—This is the initial notification that appears when the user clicks the Request Approval button.
Exception request successfully submitted for administrator review and approval —This notification appears when the user sends an approval request for a denial event, such as "execution denied" or "write denied." After the user clicks the Request Approval button, the endpoint sends the request to the ePO - On-prem administrator on the Policy Discovery page for further approval.
Note
Denial events generated by policy rules or reputation flow will not enter the Policy Discovery flow.
This request is blocked by policy. For further assistance, please contact the administrator—This notification appears when the selected event is not a denial event or is generated due to a policy ban rule or reputation ban.
This request has encountered processing issues. For further assistance, please contact the administrator—This notification appears if sending the approval request to the Policy Discovery page fails. This might occur if the file information is unavailable or if errors prevent the system from processing the necessary information to create and send the request.
Email notification dialog for approval requests
When you submit an approval request, a dialog box prompts you to enter an email address for notification purposes.
The Request button is enabled only after you enter a valid email address. You can choose to:
Provide an email address—Notifications related to the request are sent to the specified email address.
Skip notification—The request proceeds without generating a notification email. In this case, the XML generated excludes the user email tag. When you click Skip, the following message appears in the notification box of the main dialog: Exception request successfully submitted for administrator review and approval. User skipped request status notification.
Cancel the request—The request is canceled, and the XML file is not generated. When you click Cancel, the following message appears in the notification box of the main dialog: Exception request submission to the administrator failed due to user cancellation.
When you click Request, the system generates two XML files (rule.xml and request.xml) as part of the policy discovery process. These files are sent to ePO - On-prem and stored in the database. The email address associated with the request is displayed on the Policy Discovery page.
Note
On the Policy Discovery page, requests with the Approval Request status set to Received originate from the Application and Change Control Events dialog box at the endpoint. Requests with the Approval Request status set to Not Received are generated through the standard Policy Discovery flow.
Automatic Response is triggered only for Received approval requests that include a user email. You can modify the default configuration to enable responses for both Received and Not Received requests. If configured, an Automatic Response can be triggered regardless of the approval request status.
Note
An Automatic Response triggers only if an action is taken on the Policy Discovery page.
Updates to the Approval Request system:
Global actions—If an Automatic Response is configured, and before the policy is applied at the endpoint, a new request is received for an already approved Policy Discovery request, an Automatic Response triggers for the new request, and the associated user email (if available) is notified.
Custom actions—The first time a custom action is taken on a request (if the status is Received and a user email is available), the associated users are notified. If another request for the same file/groupedReqID appears under Pending Requests, then on taking a custom action, only the user emails associated with the newly received request are notified. Users who have already been notified do not receive another notification.
Configure email notifications for approval requests
As an administrator, you can configure an Automatic Response in Trellix ePolicy Orchestrator - On-premises (ePO - On-prem) to send email notifications directly to users when their requests for blocked applications are approved or rejected. This ensures users are informed of the status of their requests.
Prerequisites
Ensure you are using ePO - On-prem 5.10 SP1 Update 5 or later.
Configure an email server in ePO - On-prem under Menu → Configuration → Server Settings → Email Server.
Ensure users have provided a valid email address when submitting their approval requests.
Use the default Automatic Response
TACC includes a default Automatic Response named Notify via Email on Policy Discovery Request Approval or Rejection. This response notifies users when an administrator takes action on their submitted requests.
Registration requirements
The default response is automatically registered only if the following conditions are met:
The Automatic Response extension version is 2077 or later.
The TACC extension is a fresh installation on a supported version of ePO - On-prem, OR the extension is upgraded from version 8.4.2.40 or earlier.
Default filter configuration
The response uses specific filters to send notifications based on the request lifecycle. The response triggers when:
Event Type is Policy Discovery Event.
SC: Approval Request property is Received.
SC: User Email property is not empty.
Supported administrator actions
The notification is triggered when an administrator performs any of the following actions from the Policy Discovery page or the Details page:
Allow Globally
Ban Globally
Allow BY Certificate Globally
Allow Trusted Path Globally
Bypass Memory Protection Globally
Create Custom Policy
Create a manual Automatic Response
If the default response is not available, you must manually create one to trigger notifications.
Note
This feature requires the Automatic Response extension version 2077 or above.
Select Menu → Automation → Automatic Responses.
Click New Response.
On the Description page, enter a name and optional description for the response.
Select Solidcore Events from the Event group menu and Policy Discovery Event from the Event type menu.
Set the Status to Enabled, then click Next.
On the Filter page, select criteria to narrow down the events:
To notify only users who provided an email, select SC: User Email from Available Properties and set the Comparison to Value is not blank.
To notify only for requests with a specific status, select SC: Approval Request from Available Properties and set the Value to Received.
Click Next.
On the Aggregation page, specify grouping options, then click Next.
On the Actions page, select Send Email from the drop-down menu.
In the Recipients field, click Insert variable, select Value, then select SC: User Email and click Insert.
Enter a Subject and the Body of the email. Use Insert variable to include dynamic details such as SC: Action or SC: File Name.
Click Next, review the summary, and click Save.
How it works
User Action: When TACC blocks a file, the user clicks Request Approval in the Application Control Events dialog box and enters an email address.
Administrator Action: The request appears on the Policy Discovery page. When the administrator approves or rejects the request, an event is generated.
Notification: The Automatic Response triggers and sends an email to the address stored in the SC: User Email property.