In Observe mode, Application Control records execution, installation, and removal activities for managed endpoints.
In Observe mode, a file is allowed to execute unless it is banned by a specific rule or has malicious reputation. All observations generated on an endpoint are sent to the ePO - On-prem server after agent-server communication intervals (ASCI). When an endpoint is in Observe mode, no Application Control events are generated for the endpoint.
Activating Observe mode involves these high-level steps:
Identifying the staging or test endpoints for deployment.
If you have multiple types of endpoints in your setup, group similar types of endpoints to roll out Observe mode. This allows you to analyze product impact on each group of endpoints, discover policy groups, and validate the policies that apply to each group of endpoints.
Placing Application Control in Observe mode for a few days and perform day-to-day tasks on the endpoints.
If a reputation source is available and configured, you can review the reputation of files and certificates in your enterprise. This helps you make informed decisions for the received requests. The settings configured for your enterprise determine the reputation values that are allowed and banned.
Requests are created based on observations generated for the endpoints. These requests allow you to discover Application Control policy rules for the software installed on the endpoints.
Periodically reviewing and creating rules for the received requests.
Validating the recently added policies by running frequently used workflows. This helps you verify if more requests are received for the applications.
When the number of requests received reduces considerably, exit Observe mode and place the endpoints in Enabled mode.
Observe mode also supports reputation-based execution. When you execute a file at an endpoint, the software fetches its reputation and reputation of all certificates associated with the file to determine whether to allow or ban the file execution.
Trusted files — The file is allowed to run, unless blocked by a predefined ban rule. No corresponding observation or event is generated.
Malicious files — The file isn't allowed to execute and no corresponding observation is generated. A corresponding event is generated and displayed on the Solidcore Events page. The settings configured for your enterprise determine the reputation value that is banned. You can choose to ban only Known Malicious, Most Likely Malicious, Might be Malicious files, or all such files.
Unknown — Reputation isn't used to determine execution. Application Control performs multiple other checks to determine whether to allow or block the file.
Note
Regardless of the file's reputation, if a ban by name, SHA-1, or SHA-256 rule exists for an executable file, its execution is banned. No corresponding observation is generated. A corresponding event is generated and displayed on the Solidcore Events page.
For all processes without updater rights, these observations are generated in Enabled mode and Observe mode.
Scenario | Event generated in Observe mode | Event type in Observe mode (Agent events folder) | Activity (on the ePO - On-prem Policy Discovery page) |
|---|---|---|---|
Execution denied | No | ||
Write denied | Yes | WRITE_DENIED | File Modification |
Installation denied | Yes | PACKAGE_MODIFICATION_PREVENTED | Software Installation |
NX violation detected | No | ||
Process hijack attempted | No | ||
ActiveX installation prevented | No |
Scenario | Event generated in Enabled mode | Event type in Enabled mode (Agent events folder) | Event display name (on the ePO - On-premSolidcore Events page) |
|---|---|---|---|
Execution denied | Yes | EXECUTION_DENIED | Execution Denied |
Write denied | Yes | WRITE_DENIED | File Write Denied |
Installation denied | Yes | PACKAGE_MODIFICATION_PREVENTED | Installation Denied |
NX violation detected | Yes | NX_VIOLATION_DETECTED | Nx Violation Detected |
Process hijack attempted | Yes | PROCESS_HIJACKED | Process Hijack Attempted |
ActiveX installation prevented | No |
For all processes with updater rights, these observations are generated for memory protection-related operations in Enabled mode and Observe mode.
Process Hijack Attempted
Nx Violation Detected