{"id":4267,"date":"2026-06-08T17:57:47","date_gmt":"2026-06-08T14:57:47","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4267"},"modified":"2026-06-08T17:57:47","modified_gmt":"2026-06-08T14:57:47","slug":"how-to-create-an-elements-endpoint-protection-application-control-exclusion-rule","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/how-to-create-an-elements-endpoint-protection-application-control-exclusion-rule\/","title":{"rendered":"How to create an Elements Endpoint Protection Application Control exclusion rule"},"content":{"rendered":"

Issue:<\/h3>\n

How to create or add an Elements Endpoint Protection Application Control exclusion rule if an application has been blocked for example by a default rule.\u00a0\u00a0<\/p>\n

Resolution:<\/h3>\n

If an application has been blocked by an Application Control rule, you need to first check the block details from the Elements Endpoint Protection portal's\u00a0Security Events\u00a0<\/strong>page so that you can create an exclusion based on that information. How to view detection details:<\/p>\n

    \n
  1. Log in to the Elements Endpoint Protection portal<\/li>\n
  2. Go to the Events > <\/strong>Security Events\u00a0<\/strong>page<\/li>\n<\/ol>\n

    You can filter the Security Events page to only show Application Control events by adding a "Source equals Application control" filter.\u00a0<\/p>\n

    Open the Application Control block details by clicking the blue downwards arrow on the left side of the detection to view all the details. You can copy paste the details to a text editor to use them later when creating the exclusion rule.\u00a0<\/p>\n

    Note:\u00a0<\/strong>If multiple applications are being blocked by the same application control rule, you need to create separate exclusion rules for each application. Do not add for example several condition paths to several applications in one rule.<\/p>\n

    How to create the Application control exclusion rule:\u00a0<\/p>\n

      \n
    1. Log in to the Elements Endpoint Protection portal<\/li>\n
    2. Go to the Security Configurations ><\/strong> Profiles\u00a0<\/strong>page<\/li>\n
    3. Select the profile which is in use on the devices<\/li>\n
    4. Go to the\u00a0Application Control\u00a0<\/strong>settings page<\/li>\n
    5. Click\u00a0Add a new top rule<\/strong>\n
        \n
      • Note:\u00a0<\/strong>The rules in the table are applied in a priority order: rules are checked from top to bottom. So the exclusion needs to be up top.<\/li>\n<\/ul>\n<\/li>\n
      • Add the following:\n
          \n
        • Rule name<\/strong>, example: Exclusion for application x<\/em><\/li>\n
        • Select the Event<\/strong> type to be the same as shown in the detection\u00a0<\/li>\n
        • Select as Action\u00a0Allow<\/strong>\u00a0<\/li>\n<\/ul>\n<\/li>\n
        • Add a condition. You can from the block details you saved to a text editor check what details need to be used. For example: Target path contains C:\\Example\\Example.exe<\/span>\n
            \n
          • Note:<\/strong> If you add multiple conditions, the conditions are based on the AND principle. All conditions must apply for the rule to take effect. When adding multiple conditions, add each condition one by one an test between each added condition.<\/li>\n<\/ul>\n<\/li>\n
          • Click Save and publish<\/strong><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

            I want to know how to allow and block an application by using PSB Application Control<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4267","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000012752","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:57:47","import_hash":"fa97ee13db854141ea2996f99cd54be589ba5ed0","vanilla_article_id":32407,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32407-how-to-create-an-elements-endpoint-protection-application-control-exclusion-rule","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/4267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=4267"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=4267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}