As an Administrator, you can configure an Automatic Response in ePO - On-prem to insert user's email address and send notifications directly to users who request approval for blocked applications. This is specific to Solidcore Policy Discovery events only.
Before you begin, ensure the following:
ePO 5.10 SP1 Update 5 is installed.
Trellix Application and Change Control extension (TACC extension 8.4.3 and later) and package (for Solidcore) are installed on all required endpoints.
Solidcore extension is checked-in on the ePO Extensions page.
Email server settings are configured in ePO to send out notifications.
Go to Menu → Configuration → Server Settings → Email Server.
Enter SMTP server name, port, and sender address.
Enable TLS, if required, and Save.
You have permission to manage Automatic Response.
Create an Automatic Response Rule for Solidcore event in ePO - On-prem.
In the ePO - On-prem console, go to Menu → Automation → Automatic Responses.
Click New Response.
On the Description page, enter the following details:
Name: A name given to this Automtic Response.
Event Group: Solidcore Events
Event Type: Policy Discovery Event
Status: Enabled
Click Next.
(optional) Add filters.
(optional) Configure Aggregation.
Configure Action with Insert Email option
On the Actions page, select Send Email from the drop-down.
Under Recipients, click the Insert option. This inserts the user's email address that was added as a part of Request Approval.
Customize the Subject and Body using available variables (For example, $UserEmail$, $FileName$, and so on).
Click Next and save the Automatic Response rule.
Generate a Solidcore Policy Discovery event from client system.
Install the Trellix Application and Change Control package on endpoint systems from ePO - On-prem.
On the endpoint system, execute the application that is not on the corporate allow list. For example,
Putty.exe.A message is displayed stating that the application is not on the corporate allow list and is not allowed to run.
Click on the tray icon and select Quick Settings → Application and Change Control Events.
Locate the blocked application event (
Putty.exe) in the events log and click Request Approval.Enter the user's email address in the provided field and submit the request. This action generates two events for Solidcore Policy.
Navigate to ePO → Application Control → Policy Discovery and view these events:
Received - with user email
Not Received - without email.
The response is automatically triggered when a Solidcore Policy Discovery event matches the configured automatic response. The user who submitted the request will then receive an email notification.
Note
Automatic Response is triggered only for Received approval requests that include a user email. You can modify the default configuration to enable responses for both Received and Not Received requests.
Global actions — If an Automatic Response is configured, and before the policy is applied at the endpoint, a new request is received for an already approved Policy Discovery request, an Automatic Response triggers for the new request, and the associated user email (if available) is notified.
Custom actions — The first time a custom action is taken on a request (if the status is Received and a user email is available), the associated users are notified. If another request for the same file/groupedReqID appears under Pending Requests, then on taking a custom action, only the user emails associated with the newly received request are notified. Users who have already been notified do not receive another notification.
Trigger the response from the Policy Discovery Event page.
Go to Application Control → Policy Discovery.
Locate the event that includes the user email as Received.
Select the event and select Actions → Allow File Globally. This action allows the blocked application and logs the event and Automatic Response is triggered.
The user who submitted the request receives an email notification.
Verify execution in the Server Task log.
Go to Menu → Automation → Server Task Log.
Verify the status of the Automatic Response to confirm that the email was sent.