Environment
- App Control Console: All Supported Versions
Objective
Instructions on how to make a new file type interesting to track and monitor.
Resolution
To make a new file type interesting:
1. In the console menu, go to Rules > Software Rules, and on the Software Rules page, click the Scripts tab
2. Click the "Add Script Rule" button
3. In the Rule Name field, enter the name you want to appear on the list of rules. Description is optional
4. Choose a Platform and select Script Type and Process for the "Script Definition"
5. Enter the "Script Type" (usually the asterisk followed by a dot and the file extension)
6. Enter the process that interacts with the files in the "Scrip Process" field
7. Check "Rescan Computers" to add the new rule to your agents
8. Click the Save button to save the rule
9. The rule now appears on the Script Rules page but keep in mind that if the hash changes a block will be received until a custom rule is added for it
Additional Notes
Now that the new files are interesting, they will need approved or allowed with a rule in the policy that is being used by the Agent.
Related Content
