Network Prevent for Email

Network Prevent for Web

Network Monitor

Network Discover

Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.

Add a “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.

Add “custom_app.exe” as a filename exception to the Endpoint Prevent policy.

Monitor incidents and tune the policy to reduce false positives

Define and build the incident response team

Establish business metrics and begin sending reports to business unit stakeholders

Test policies to ensure that blocking actions minimize business process disruptions

Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected

Modify the agent configuration and select the option “Retain Original Files”

Modify the agent config.db to include the file

Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

Endpoint Prevent: Block

All: Send Email Notification

Endpoint Discover: Quarantine File

Network Protect: Quarantine File

Endpoint Prevent: User Cancel