What it does
From the App control tab of the response panel, or from a playbook, you can block an application on a host by image name or by file hash, and unblock it later. The block is recorded with the operator identity and can carry a note.
Enforcement
Blocks take effect immediately. The agent enforces each one with the strongest option the host supports; each host reports the options it offers, and the console shows which one applied each block.
Choosing a block
- By hash stops a specific file wherever it is and whatever it is called.
- By image name stops a program by name, immediately, on every Windows edition.
Every block is reversible from the same tab, or from the alert or case that applied it, and both the block and its release are in the audit trail.