By default, the self-approval feature is disabled on endpoints. You can configure a policy to enable this feature on selected endpoints.
After the feature is enabled, users can approve an unknown or new application on a protected endpoint and run it.
On the ePO - On-prem console, select Menu → Policy → Policy Catalog.
Select Solidcore 8.x.x: Application Control for the product.
Select Application Control Options (Windows) for the category.
Click the My Default policy to edit it.
Note
By default, the My Default policy is applied to all endpoints in your enterprise. To enable the self-approval feature for selected endpoints, duplicate the My Default policy, edit the settings, and apply the policy to only the relevant endpoints.
Select Enable Self-Approval.
(Optional) Specify the message to display to the users on the endpoints when they try to run a new or unknown application.
This specified text is displayed on the endpoint in the Trellix Application Control - Self-Approval dialog box.
Specify a timeout value for the user to take an action when the Trellix Application Control – Self-Approval dialog box is displayed.
If the user doesn’t take action in the specified time, the attempted action is automatically denied and the dialog box closes.
Specify whether it is mandatory or optional for the user to provide a business need while allowing an action on the endpoint.
(Optional) Specify the advanced options.
If you select this option, all applications that run on the system while it is booting or when an interactive session is unavailable are allowed to execute.
Save the policy and apply to endpoints.
After the policy is applied, the self-approval feature is enabled on the endpoints.