App Control: How to Setup a Performance Optimization Rule to Ignore Directory Writes

[#1]

Environment

• App Control: 7.2.x and Higher

Objective

Create a custom rule for Performance Optimization to allow App Control to ignore write actions in a directory

Resolution

1. In the console menu, choose Rules > Software Rules
2. On the Software Rules page, click the Custom tab
3. Click the Add Custom Rule button
4. In the Rule Name field, enter the name with which you want to identify this rule
5. By default, a new custom rule is Disabled as soon as you define it and click Save. If you want the rule to take affect immediately, click Enabled in the Status field
6. Choose the Platform you want this rule applied to (Windows, Mac, or Linux) 
7. Choose the Rule Type Performance Optimization
8. Enter the remaining fields you want for this Performance Optimization rule

Additional Notes

Executions will still be monitored but Performance Optimization rules will specify folders or files to avoid tracking writes
For Windows procmon can be used to help identify potential paths and processes that may benefit from a PO rule

Related Content

Cb Protection User v8.1.0 User Guide-GA version
All Products: How to Collect a low Altitude Procmon Capture