Application Control creates a whitelist of all authorized executable files. When you attempt to run an executable file that is not whitelisted, Application Control blocks its execution.
The whitelist details authorized files and determines trusted or known files. In Enabled mode, only files that are present in the whitelist are allowed to execute. All files in the whitelist are protected and can't be changed or deleted.
- A user or application tries to execute a file where Application Control and Trellix Agent are installed.
- Solidcore Agent and Trellix Agent are installed on the managed endpoints. When a user or application tries to execute a file, Trellix Agent registers the attempt and sends the event to Trellix ePO - On-prem.
- Solidcore Agent checks if the executable is added to the inventory as whitelisted.
- If the executable is whitelisted, the file is allowed to run.
