Apply a CSV Ruleset to Endpoints in BigFix Application Control

Use the Apply CSV Ruleset mode in the Task: Set Policy Modifications to bulk-manage application Allow and Block rules on managed endpoints by reading from centrally maintained CSV files. Based on the Rule Type selected, the task reads allowlisted_applications.csv or blocklisted_applications.csv from the BigFix Master Action Site and creates or updates the matching rule in the endpoint's local bes_bac.pol policy file — without modifying the task action script.

Before you begin

Before running the Apply CSV Ruleset mode, complete the following prerequisite steps:
  1. Create the CSV files
    Create blocklisted_applications.csv (for Block rules) and allowlisted_applications.csv (for Allow rules). Both files must contain exactly two column headers: Path Patterns and Hashes.
    Note:
    Download sample CSV format files from the parent task topic: Set Policy Modifications on Endpoints in BigFix Application Control.
  2. Upload the CSV files to the Master Action Site
    1. In the BigFix Console, navigate to Master Action Site.
    2. Select the Files tab.
    3. Right-click and select Add Files.
    4. Select the CSV files you created.
    5. Select the Send to Clients check box — this step is required for the task to distribute the CSV files to managed endpoints.
    6. Click Add Files.
This task performs the following actions:
  • Based on the selected rule type (Block or Allow), it reads the corresponding source file: blocklisted_applications.csv or allowlisted_applications.csv.
  • From the source file the list of application file paths and/or file hashes are extracted.
  • The task then searches for the rule specified by the Rule Name in the effective_policy.json file.
    • If the rule exists, the JSON file is updated with the latest information.
    • If the rule does not exist, it's added as a new entry.

This way bulk dynamic management of application block/allow list is achieved without altering the task action script.

About this task

Learn how to apply CSV rulesets on Application Control managed endpoints.

As an administrator, you can create or update Application Control rules on endpoints by dynamically reading from centrally managed CSV files. BigFix Application Control updates the local JSON policy file on the endpoint with application paths and hashes, allowing administrators to either allow or block specific applications as needed.

You need to use the mode Apply CSV Ruleset for dynamically creating or modifying rules on endpoints.

Perform the following steps to apply CSV rulesets to an endpoint:

Procedure

  1. From the Task: Set Policy Modifications pane, on the Description tab, select Apply CSV Ruleset from the Select Mode drop-down and enter the following information:
    Figure 1. BigFix Application Control — Task: Set Policy Modifications — Apply CSV Ruleset Mode Configuration Fields (Rule Name, Rule Type, Rationale)

    BigFix Application Control Task Set Policy Modifications pane showing the Apply CSV Ruleset mode configuration fields: Select Mode set to Apply CSV Ruleset, Rule Name (identifies the rule to create or update in the policy file), Rule Type (Block reads from blocklisted_applications.csv, Allow reads from allowlisted_applications.csv), and Rationale for the rule.
    Table 1. BigFix Application Control — Task: Set Policy Modifications — Apply CSV Ruleset Mode Configuration Fields Reference
    Field Name Description
    Select Mode Select Apply CSV Ruleset from the drop-down to activate this mode.
    Rule Name The name of the rule to create or update. The task searches for this rule name in the effective_policy.json file — if the rule exists, it is updated with data from the CSV; if it does not exist, it is added as a new entry.
    Rule Type The type of rule to apply:
    • Select Block to read from blocklisted_applications.csv and create or update a Block rule on the endpoint.
    • Select Allow to read from allowlisted_applications.csv and create or update an Allow rule on the endpoint.
    Rationale A description or reasoning for the rule, for audit and documentation purposes.
  2. From the Take Actions tab and select the endpoints on which you want to apply the CSV rulesets.
  3. Click OK.

Results

The task reads the appropriate CSV file from the BigFix Master Action Site, extracts the application file paths and hashes, and creates or updates the matching rule in the bes_bac.pol local policy file on the target endpoints. The BESBAC service enforces the updated rules immediately. The applied rules are reflected in the corresponding Allowed or Blocked Path Pattern and Hash Rule fields in Analyses: Effective Configuration for each endpoint.