You can configure a trusted executable, an executable associated with a rule or group, or add an executable to the Firewall Catalog. (Windows & macOS only)
Trusted executables are those deemed safe in any environment and have no known vulnerabilities. These executables are allowed to perform all operations except operations that suggest that the executables have been compromised.
Firewall treats all files and folder names in rules as case insensitive. For example, if a Firewall rule specifies to block C:\Temp\FTP.exe, Firewall also blocks C:\temp\ftp.exe and c:\TEMP\FTP.EXE. (Windows only)
| Option | Definition |
|---|---|
| Name | Specifies the name that you call the executable.
This field is required with at least one other field: File name or path, File description, MD5 hash, or signer. |
| File name or path | Specifies the file name or path of the executable to add or edit.
The file name or path can include wildcards. |
| File description | Indicates the description of the file. This field is used to verify an application's file description inside the executable itself.
To view the file description for an executable, right-click the executable, select Properties, then click the Details tab to see the Description information.
|
| MD5 hash (Windows only) | Indicates the MD5 hash (32-digit hexadecimal number) of the process. |
| Signer (Windows only) |
Enable digital signature check —
Guarantees that code hasn't been changed or corrupted since it was signed with cryptographic hash.
If enabled, specify:
From Trellix ePO - On-prem Event Log, copy and paste the details from the Source Signer Process field from an Trellix ENS event. |
| Notes | Provides more information about the item. |