App Control: How to Tell Which Rule Is Causing a Block?

[#1]

Environment

• App Control Console: All Supported Versions

Question

What is the best method to determine which rule is causing a file to be blocked?

Answer

1. Login to the App Control console
2. Add the "Rule Name" column:
   1. Navigate to Reports > Events
   2. Click on "Show Columns"
   3. Find "Rule Name" and move to the "Selected" section.
   4. Click Apply
3. Look at the "Rule Name" column for relevant block events