Set a New Allow or Block Rule on Endpoints Using BigFix Application Control

Use the Set New Rule mode in the Task: Set Policy Modifications to create and deploy a custom Allow or Block application control rule on managed endpoints. Define the rule by file path pattern (with wildcard support), SHA-256 or SHA-384 file hash, or both. New rules are added to the endpoint's local bes_bac.pol policy file and enforced immediately by the BESBAC service.

About this task

Use the Set New Rule mode to create and deploy application control rules on managed endpoints.
This mode in the Task: Set Policy Modifications allows administrators to create and deploy Application Control rules on target endpoints. Administrators can define Allow or Block application rules based on file path patterns or specific file hashes. This mode enforces security policies, prevents execution of unauthorized processes, and hardens endpoints against malware.
Note:
All rule and policy data is encrypted in BigFix Application Control. Application Control uses JSON files to communicate between the BigFix® and its endpoints. All data in the JSON files is encrypted and cannot be circumvented.

Select Set New Rule from the Select Mode drop-down in the Task: Set Policy Modifications pane to set new rules on endpoints.

Perform the following steps to create and deploy a new application control rule on managed endpoints:

Procedure

  1. From the Task: Set Policy Modifications pane, on the Description tab, select Set New Rule from the Select Mode drop-down and enter the following information:
    Figure 1. BigFix Application Control — Task: Set Policy Modifications — Set New Rule Mode Configuration Fields (Rule Name, Rule Type, Path Pattern, File Hash, Rationale)

    BigFix Application Control Task Set Policy Modifications pane showing the Set New Rule mode configuration fields: Select Mode set to Set New Rule, Rule Name, Rule Type (Allow or Block), Path Pattern (executable name or file path with wildcard support), File Hash (SHA-256 or SHA-384), and Rationale for the rule.
    Table 1. BigFix Application Control — Task: Set Policy Modifications — Set New Rule Mode Configuration Fields Reference
    Field Name Description
    Select Mode Select Set New Rule from the drop-down to activate this mode.
    Rule Name A clear, unique name for the rule (for example, "Block unauthorized torrent applications"). If a rule with the same name already exists on the endpoint, the task fails.
    Rule Type The type of rule to create. Select Allow to explicitly permit an application to run, or Block to explicitly deny an application from running.
    Path Pattern The file path of the application or process to be allowed or blocked. Enter an executable name (for example, msedge.exe) or a full file path. Wildcards (*) are supported. For multiple entries, use a comma-separated list (for example, C:\Temp*.exe,C:\Users*\downloads*.exe).
    File Hash The SHA-256 or SHA-384 hash value of the application file, for a more specific rule that targets a precise file version. For multiple hashes, use a comma-separated list.
    Rationale A description or reasoning for the rule, for audit and documentation purposes.
    Note:
    Provide a value for either Path Pattern or File Hash for the rule to be valid. For more effective control, use a combination of both wherever feasible.
  2. Select the Take Actions tab and select the endpoints on which you want to apply the new rules.
  3. Click OK.

Results

The new Allow or Block rule is added to the bes_bac.pol local policy file on the target endpoints and enforced immediately by the BESBAC service. The applied rule is reflected in the corresponding Allowed or Blocked Path Pattern and Hash Rule fields in Analyses: Effective Configuration for each endpoint.