Frequently asked questions

Here are answers to frequently asked questions.

What features are enabled with which license?

What are these features?

What is the execution decision flow of Application Control?

For more information about execution decision flow of Application Control, see KB85695.

Which one takes precedence in monitoring (file, user, or folder)?

The order of precedence is considered as listed:

How to handle Memory Leak from scsrvc.exe (User-mode)

Before you start collecting traces, you need to define how long it takes for the Application Control process to consume all available RAM from the Operating System, so you can divide the time and use it to capture 4 traces. Also, enable the advanced debugging for scsrvc.exe in Gflags tool (Global Flags Editor).

Gflags tool is included in Debugging Tools for Microsoft Windows. For more information, see Download Debugging Tools for Windows.

Once the debugging kit is installed, the tool (gflags.exe) is saved in: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 for Systems running 64 bits Windows or C:\Program Files (x86)\Windows Kits\10\Debuggers\x86 running 32-bits version of Windows.

In addition, you need poolmon.exe which is also part of the debugging tools, and procdump.exe which can be downloaded from Microsoft Sysinternals tool website. For details, click here.

Note

If the debugging package is installed while the product is in Update mode, all tools are solidified. But, if you are copying the tool from another system or downloading while the product is in Enabled Mode, solidify the tools or change the product to Update Mode. Otherwise the execution is denied.

Instructions to start the advance trace for scsrvc.exe:

Scenario for data collection: If scsrvc.exe takes 48 hours to reach 4-GB RAM (all available RAM), you can reduce the trace time, because the 0-GB trace does not have enough info and 4-GB RAM trace might be hard to capture as the system might be in a crash state. So, in case, you remove 8 hours, in total we have 40 workable hours to capture 4 traces.

Every 10 hours, you must capture: poolmon and process dump (procdump) at the same time, using these commands:

How to handle memory Leak from Solidcore Tags (Kernel Mode)

In kernel mode, Solidcore tags name start with: Q*.

This issue is exhibited when these tags don't release allocated memory, which leads to system crash and the only way to recover is by rebooting it.

Before collecting any trace, you need to configure your system to generate full memory dump, and this is due to the nature of the issue, no User-mode processes exhibit high consumption generally.

Following instructions to force a system crash by pressing a combination of keys. For instructions, click here.

When configuring the dump options in Control Panel > System and Security > System. Click Advanced system settings. Under Startup and Recovery, click Settings. Select Complete Memory Dump in Write Debugging Information.

Like the user-mode scenario, you can define a time frame to capture 4 poolmon, and a full memory dump (forced through keyboard) when the system crashes or is unresponsive.

How to manually Purge data from ePO - SaaS?

Application Control collects and store information from all endpoints. This information can be categorized as: events, inventory, and Policy Discovery. Trellix Recommends that after all data is reviewed by the Solidcore Administrator, it needs to be purged to avoid data redundancy and performance degradation on the database caused by the product extension.

From ePO - SaaS, all purging tasks can be created and scheduled from Server Tasks:

The following schedule frequencies need to be adapted in compliance with your company auditing and data restore policies:

Solidification FAQs

What files do we solidify?

How to view scripts that can be solidified?

Run the following command to view scripts:

Sadmin Scripts list

How to determine if something is Solidified (on the allow list)?

Run the following command to list solidified items:

Sadmin ls

Run the following command to list unsolidified items:

Sadmin lu

Run the following command to get advanced details about a file:

Sadmin ls - lax

What hashes are collected in inventory?

Hashes collected for inventory:

What is collected in Solidcore inventory file?

Inventory file contains details such as hash, reputation, and location.

Where can you view your client inventory?

On the ePO - SaaS console, select Menu → Application Control → Inventory.

What is the function and specific use cases for each skiplist?

You can add skip rules using the sadmin skiplist add command and specify the needed arguments to skip path components from several features such as monitoring, write protection, file operations and script-auth, allow list, and Application Control.

Monitoring

Skiplist -c is used predominately in the Update mode to disable monitoring on files. This can be used to quiet events from showing up in TACC events. Think of a more powerful filter built into operate while in the Update mode.

Write protection

Skiplist -d is used to deny write passthrough attribute. This skiplist removes write protection from a file allowing it to be changed by any source.

Skiplist -r creates a registry path passthrough attribute. This process allows an application to modify the registry.

File operations and script-auth

Skiplist -f is used to create file operations passthrough. This rule allows you to create, modify, and delete files regardless of solidification. It will not allow you to overwrite links and rename files.

Skiplist -i or ignore passthrough attribute, ignores path, and works similar to a skiplist -f.

Allow list

Skiplist -s is a process used to bypass the solidification status of a file. This process also unsolidifies files.

Application Control

Skiplist -v is used to exclude a volume or drive from being allow listed.

What is an Alternate Data Stream (ADS)?

On the Microsoft NTFS file system, a file consists of multiple data streams. One stream holds the file contents and another contains security information. You can create alternate data streams (ADS) for a file to associate information or other files with the existing file. In effect, alternate data streams allow you to embed information or files in existing files. The ADSs associated with a file do not affect its contents or attributes and are not visible in Windows Explorer. So, for practical purposes, the ADSs associated with a file are hidden. Malicious users can misuse the ADS feature to associate malicious files with other files without the malicious files being detected.

What are the implications of recovering the local CLI access for an endpoint?

To troubleshoot or debug issues, you might need to recover the local CLI access for an endpoint. Recovering the local CLI for an endpoint prevents the enforcement of policies from ePO - SaaS to the endpoint. This implies that when the CLI is recovered for an endpoint, no existing or new policies (created on the ePO - SaaS server) are applied to that endpoint.

What is the significance of the label specified in a policy while configuring updater processes, installers, and users?

The specified labels help you correlate the generated events with the actions performed by the trusted resources. For example, when an event is generated for an action performed by a trusted user, the Workflow ID attribute for the event includes the label specified for the trusted user.

How do I unsolidify a file, directory, or volume?

To unsolidify a file, directory, or volume, run the SC: Run Commands client task with the sadmin unso <resource name> command.

Note

As a best practice, do not unsolidify a system drive or volume.

Do Application Control work in Network Address Translation (NAT) environments?

If the ePO - SaaS server can communicate with the Trellix Agent in a NAT environment, then Application Control works as expected.

How can I trust applications developed for use in my organization?

Sign the applications with a self-generated certificate, then trust the certificate.

Can I script sadmin commands?

Yes, you can script sadmin commands. While recovering the CLI, you are prompted to enter to password. To achieve this in a script, suffix the sadmin recover command with -z <password>.

How can I resolve discrepancies and inconsistencies in the Solidcore rule groups after upgrading the Solidcore extension? When I access the Rule Groups page, an Internal Server Error is displayed.

Run the Rule Group Sanity Check server task from the ePO - SaaS console to fix the inconsistencies in the rule groups. This server task reports and corrects (if possible) discrepancies and inconsistencies in the Solidcore rule groups and policies.

How do I manage the predefined rules available with Application Control?

Revisit the predefined rules available with Application Control when you install or upgrade the Solidcore extension. Because the software installed on the endpoints in your enterprise might change (is added or removed), you must revise the rules periodically. Based on the software installed on the endpoints in your setup, revise the rules and remove unwanted or irrelevant rules.

How can I enable or disable selected features on endpoints from the ePO - SaaS console?

Use the Application Control Options (Windows) policy to enable or disable selected features on endpoints from the ePO - SaaS console.

After I deploy Application Control, how can I check the status of the memory protection techniques, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), provided by the Windows operating system?

Here are the possible values for DEP and ASLR.

The software is allowing the execution of a banned file. What could be the reason?

When defined rules are applied, the software combines or aggregates the rules defined for a file. When applying the rules, it uses the following order to determine whether the file execution is allowed or blocked. The order in which the methods are listed indicates the precedence the software applies to the method.

If none of the above apply for a file, the software blocks the execution of the file.

How can I check the solidification or allow listing status for an endpoint?

Perform these steps to review the solidification or allow listing status for an endpoint.

How can I apply multiple policies to one node in the System Tree?

Perform these steps to apply multi-slot policies to a group or specific endpoints.

I am trying to fetch the software inventory for an endpoint, but the SC: Pull Inventory client task fails and I receive a message that the inventory cannot be fetched. What is the reason and how can I fetch the inventory successfully?

By default, you can fetch the inventory for an endpoint once in seven days. This value is set as the minimum interval between consecutive inventory runs. But, if needed, you can configure this value for your enterprise. See Configure settings for fetching the inventory.

What is the difference between custom action and taking global actions for a request?

For selected endpoints, to define custom rules to allow, ban, or allow by certificate an application or executable file, use the Create Custom Policy action. You can also define custom rules to allow a network path for selected endpoints. But, to allow, ban, allow by certificate an application or executable file globally (on all endpoints in your enterprise), or to allow a network path globally, take global actions.

I am using the Number of Systems where Throttling Initiated in Last 7 days monitor on the Health Monitoring dashboard. Why is no data visible when I select List events that initiated throttling for a system link?

When you select the List events that initiated throttling for a system link, the Events page lists events that resulted in the generation of the Data Throttled or Data Dropped events. The list includes all events that were generated in the 7-days period before receiving the Data Throttled or Data Dropped events.

In these two scenarios, the Events page does not list any data.

Also, the same scenario can occur for policy discovery requests (observations) and inventory updates.

I want to change the value of a configuration parameter for a managed endpoint. I cannot find a policy or method to complete this from the ePO - SaaS console. How can I complete tasks for which no method is available on the ePO - SaaS console?

From the ePO - SaaS console, you can use the SC: Run Commands client task to run any CLI commands remotely on one or more endpoints. The commands can include tasks that can or cannot be completed using ePO - SaaS, such as enable or disable the product, change the value for configuration parameters, or fetch the software inventory.

How can I lock down or recover the local CLI for managed endpoints?

By default, the local CLI is locked down for ePO - SaaS-managed endpoints. But, you can recover the CLI for one or more endpoints, if needed.

Important

When you recover the CLI, any changes to configuration, policies, tasks pushed from the ePO - SaaS server are not enforced on the endpoint. So, the CLI status must be set to Restrict to enforce any changes to the endpoint.

How can I view the reputation for a specific file on an endpoint?

To view the reputation for a specific file on an endpoint, fetch the file reputation from a source (Trellix GTI, or Intelligent Sandbox), as applicable. But, make sure that the reputation setting is enabled in Application Control (Options)policy applied to the endpoint. For more information about how to enable reputation settings, see Configure reputation settings.

Use the SC: Run Commands client task to run this command on the endpoint.

sadmin getreputation [ -v | -b ] -f <filename> -m <md5> -h <sha-1> -s <reputation-source>

You must specify MD5 and SHA-1 value for a file to fetch its reputation. But, if you also specify the file name with its MD5 and SHA-1 value, the file name is considered for fetching the reputation.

This table lists the supported arguments and their description.

How can I recover the CLI for an endpoint if the CLI is disabled after multiple incorrect password attempts?

If the CLI is disabled after multiple incorrect password attempts, there are two methods to recover the CLI:

When the CLI is recovered, the Recovered Local CLI event is sent to the ePO - SaaS console to notify the administrator.

When using Application Control, which features and workflow support SHA-1 and SHA-256?

We have added support for file SHA-256 values (for the Windows platform). This table lists how existing features and workflows use SHA-1 and SHA-256 values.

Except when stated, all other Application Control workflows are based on file SHA-1 values. In other words, the linking between events (on Solidcore Events page), file details (on Inventory pages), and requests (Policy Discovery page) are based on the file's SHA-1 values.

I recently fetched inventory for an endpoint and need to fetch inventory for it again. How can I do this?

For Application Control, the minimum interval between consecutive inventory runs (when the inventory information is fetched from the endpoints) is set to seven days. This is the default value and implies that for an endpoint you can pull inventory once a week. But, if needed, you can configure this value for your enterprise. See Configure settings for fetching the inventory.

One of these happen when you fetch inventory for an endpoint:

I received the Unable to Recover Inventory event for an endpoint. What can I do?

The Inventory Corrupted event is generated for an endpoint if the internal inventory for the endpoint is corrupt. Application Control maintains inventory backup for the endpoint and recovers the inventory for the endpoint from the backup copy.