Allowlist Management

Allowlist

Allowlist defines all the executables that are allowed to execute. The list of executables are populated after the reference host scan. Some of them are auto-allowlisted as per the configuration on Host profile/template. This can be modified or optimized as described in the below sections.

The below table represents the different status values of executable threat intelligence along with their descriptions:

Modify at the Profile-level

1. On the Host Monitoring page, expand the profile and click Edit Allowlist
2. All executables are listed along with their Threat Intelligence, Path, Allowlisted libraries (if any), Source (Scan or Incident), Library Monitoring (Enabled/Disabled) and Allowlist (or not)
3. The “Not allowlisted” status is depicted below
4. The list displays Threat Intelligence. A mouse-over will display the details
5. Select the Library/Script Auto Allowlisting option. This enables the automatic allowlisting of Safe only libraries OR all libraries OR none of the libraries depending on the selected drop-down. The Script Auto Allowlisting tab is populated when an ACP is applied to the profile
6. Select the required processes
7. Associated Binaries
   1. Click the Allowlisted Binaries entry and select all the required libraries, click Close
   2. Alternatively, select the appropriate Library Monitoring Option
8. The changed process is indicated as depicted below:
9. Click the required Allowlist option. Click YES on the confirmation screen
10. Publish/Discard the changes using the appropriate option. During the process of publishing, options of edit, delete, protection mode change or host association/disassociation are disabled

Modify across Profiles

1. Execute a search on the Profile List. Select all the required processes to be allowlisted from the search results
2. Select the appropriate option under LIBRARY MONITORING. This option applies to the search results ONLY
3. Select the Library/Script Auto Allowlisting option at the top of the page
4. Click the required Allowlist option. Click YES on the confirmation screen. This option applies to the search results ONLY
5. Alternatively, click the Allowlisted Libraries entry associated with a particular process
   1. Select the required libraries to be allowlisted. Select the appropriate option under ALLOWLIST and click YES on the confirmation screen
6. Publish/Discard the changes using the appropriate option at the profile level
7. Alternatively, use the below dropdown for bulk publish/discard across profiles

Optimize Allowlist

The Optimize Allowlist option clears/optimizes the allowlist when exclusions are added. Although this clean-up is automated, it can be manually initiated using this option. It ensures that all the matching executables with the global exclusion list are purged from the individual Host Profiles. The corresponding incidents are marked as Acknowledged.

1. To optimize the existing allowlist, click ALL PROFILES > Exclusions List > Optimize Allowlist
2. Click YES on the confirmation screen

Publishers (Windows)

VSP provides an option to add a list of Publishers of files (files signed by known publisher) to the allowlist for Windows Probes. When processes with the allowlisted Publishers are launched, they are allowed to execute. Incidents are not reported in CMS for such processes. The list is added with new Publishers using the below sources:

1. Publishers of files scanned on the hosts when a profile is created
2. Publishers obtained from VSP detected incidents
3. Publishers manually added from the CMS

By default, host protection allows binaries with expired Publisher Certificates. To block binaries with expired Publisher Certificate, execute the command:

vsp-cli config hmm edit winCheckExpiration True --persist

The Publishers list can be defined at the global level or profile level.