What it does
From the App control tab of the response panel, or from a playbook, you can block an application on a host by image name or by file hash, and unblock it later. The block is recorded with the operator identity and can carry a note.
Enforcement
Blocks take effect immediately. The agent enforces each one with the strongest option the host supports; each host reports the options it offers, and the console shows which one applied each block.
Choosing a block
- By hash stops a specific file wherever it is and whatever it is called.
- By image name stops a program by name, immediately, on every Windows edition.
Every block is reversible from the same tab, and both the block and its release are in the audit trail.