Experiencing a breach?
Select Language
Contact support
Languages
Contact support
Back to Home

placeholder-title

placeholder-link
Back to Home

Login

Back to Home

Languages

English Finnish French German Japanese

Support articles

Find clear, step-by-step solutions to common WithSecure issues across installation, configuration, updates, and product performance.

Why does Elements Application Control not block an application, even if Global rule is set as Block all untrusted applications

Last updated

Issue:

Why does Elements Endpoint Protection Application Control  feature not block an application, even if Global rule is set as "Block all untrusted applications". 

How to know which applications are allowed by the Application Control feature when Global rule is set as "Block all untrusted applications"

 

 

Resolution:

In case you set the Elements Endpoint Protection Application Control Global rule is to "Block all untrusted applications", Application Control will allow applications to run if they:

  • Are running from SYSTEM account
  • Have a target prevalence greater than 40 and reputation less than 9
  • Application is a known clean application and trusted signed application
  • Application has an explicit allow rule created for it

Here is an explanation of the target prevalence and reputation values:

Reputation properties

Reputation properties can have the following values:

Range Type Meaning
0-9 CLEAN Known clean. Allow everything.
10-79 PROMPT Suspicious or potential unwanted (PUA) or Riskware. Prompt the action from the local user.
80-89 UNWANTED Unwanted Application. Automatic quarantine with option to exclude.
90-100 BLOCK Known malicious. Block all actions.
101-999 UNKNOWN Make a local decision. This is the default also when there is no response (empty response).

Prevalence property

Prevalence property can have the following values:

Value Meaning
0 Undefined or not known. This is the default also when no response or if this flag is missing.
1 Unique file (3 or less hits)
10 Very rare file (10 or less hits)
20 Quite rare file (100 or less hits)
30 Rare file (1000 or less hits)
40 Unusual file (10 000 or less hits)
50 Semi-common file (100 000 or less hits)
60 Common file (1 000 000 or less hits)
70 Common file (10 000 000 or less hits)
80 A very common file (100 000 000 or less hits)
90 A very very common file (1 000 000 000 or less hits)
100 Everybody basically has this (10 000 000 000 or less hits)

We recommend to change the Global rule  to "Allow and monitor all applications" to monitor the situation at first, and slowly creating new Application Control rule(s) to allow the application running in your environment.