Application Control creates a allow list of all authorized executable files. When you attempt to run an executable file that isn't allowed, Application Control checks the reputation of the file and allows or blocks its execution.
A user or application tries to execute a file on a managed endpoint where Application Control and Trellix Agent are installed.
Application Control checks the reputation of the file and allows or blocks its execution.
Application Control communicates with the Trellix Threat Intelligence Exchange (TIE) servers to receive reputation information for the file and any associated certificates. Based on this information, Application Control allows or blocks the file execution.
If the TIE server is unavailable, Application Control communicates with the Global Threat Intelligence server to fetch the reputation of the file.
Trellix Data Exchange Layer provides the framework for communication between Application Control and TIE or Trellix GTI, so products can share threat information.
The administrator manages all endpoints, deploys policies, creates rules, adds certificates, manages the inventory, monitors activities, and approves requests.
Information about the attempt to run the application is sent to the ePO - On-prem server, where it appears in a dashboard, report, or log.
