|
| 1 | +[[security-blocklist]] |
| 2 | += Blocklist |
| 3 | + |
| 4 | +// :keywords: serverless, security, how-to |
| 5 | + |
| 6 | +preview:[] |
| 7 | + |
| 8 | +The blocklist allows you to prevent specified applications from running on hosts, extending the list of processes that {elastic-defend} considers malicious. This helps ensure that known malicious processes aren't accidentally executed by end users. |
| 9 | + |
| 10 | +The blocklist is not intended to broadly block benign applications for non-security reasons; only use it to block potentially harmful applications. To compare the blocklist with other endpoint artifacts, refer to <<security-optimize-edr>>. |
| 11 | + |
| 12 | +.Requirements |
| 13 | +[NOTE] |
| 14 | +==== |
| 15 | +* In addition to configuring specific entries on the **Blocklist** page, you must also ensure that the blocklist is enabled on the {elastic-defend} integration policy in the <<malware-protection,Malware protection settings>>. This setting is enabled by default. |
| 16 | +* You must have the appropriate user role to use this feature. |
| 17 | +
|
| 18 | +// Placeholder statement until we know which specific roles are required. Classic statement below for reference. |
| 19 | +
|
| 20 | +// * You must have the **Blocklist** <DocLink slug="/serverless/security/endpoint-management-req">privilege</DocLink> to access this feature. |
| 21 | +==== |
| 22 | + |
| 23 | +By default, a blocklist entry is recognized globally across all hosts running {elastic-defend}. You can also assign a blocklist entry to specific {elastic-defend} integration policies, which blocks the process only on hosts assigned to that policy. |
| 24 | + |
| 25 | +. Find **Blocklist** in the navigation menu or use the global search field. |
| 26 | +. Click **Add blocklist entry**. The **Add blocklist** flyout appears. |
| 27 | +. Fill in these fields in the **Details** section: |
| 28 | ++ |
| 29 | +.. `Name`: Enter a name to identify the application in the blocklist. |
| 30 | +.. `Description`: Enter a description to provide more information on the blocklist entry (optional). |
| 31 | +. In the **Conditions** section, enter the following information about the application you want to block: |
| 32 | ++ |
| 33 | +.. `Select operating system`: Select the appropriate operating system from the drop-down. |
| 34 | +.. `Field`: Select a field to identify the application being blocked: |
| 35 | ++ |
| 36 | +*** `Hash`: The MD5, SHA-1, or SHA-256 hash value of the application's executable. |
| 37 | +*** `Path`: The full file path of the application's executable. |
| 38 | +*** `Signature`: (Windows only) The name of the application's digital signer. |
| 39 | ++ |
| 40 | +[TIP] |
| 41 | +==== |
| 42 | +To find the signer's name for an application, go to **Discover** and query the process name of the application's executable (for example, `process.name : "mctray.exe"` for a McAfee security binary). Then, search the results for the `process.code_signature.subject_name` field, which contains the signer's name (for example, `McAfee, Inc.`). |
| 43 | +==== |
| 44 | +.. `Operator`: For hash and path conditions, the operator is `is one of` and can't be modified. For signature conditions, choose `is one of` to enter multiple values or `is` for one value. |
| 45 | +.. `Value`: Enter the hash value, file path, or signer name. To enter multiple values (such as a list of known malicious hash values), you can enter each value individually or paste a comma-delimited list, then press **Return**. |
| 46 | ++ |
| 47 | +[NOTE] |
| 48 | +==== |
| 49 | +Hash values must be valid to add them to the blocklist. |
| 50 | +==== |
| 51 | +. Select an option in the **Assignment** section to assign the blocklist entry to a specific integration policy: |
| 52 | ++ |
| 53 | +** `Global`: Assign the blocklist entry to all {elastic-defend} integration policies. |
| 54 | +** `Per Policy`: Assign the blocklist entry to one or more specific {elastic-defend} integration policies. Select each policy where you want the blocklist entry to apply. |
| 55 | ++ |
| 56 | +[NOTE] |
| 57 | +==== |
| 58 | +You can also select the `Per Policy` option without immediately assigning a policy to the blocklist entry. For example, you could do this to create and review your blocklist configurations before putting them into action with a policy. |
| 59 | +==== |
| 60 | +. Click **Add blocklist**. The new entry is added to the **Blocklist** page. |
| 61 | +. When you're done adding entries to the blocklist, ensure that the blocklist is enabled for the {elastic-defend} integration policies that you just assigned: |
| 62 | ++ |
| 63 | +.. Go to the **Policies** page, then click on an integration policy. |
| 64 | +.. On the **Policy settings** tab, ensure that the **Malware protections** and **Blocklist** toggles are switched on. Both settings are enabled by default. |
| 65 | + |
| 66 | +[discrete] |
| 67 | +[[manage-blocklist]] |
| 68 | +== View and manage the blocklist |
| 69 | + |
| 70 | +The **Blocklist** page displays all the blocklist entries that have been added to the {security-app}. To refine the list, use the search bar to search by name, description, or field value. |
| 71 | + |
| 72 | +[role="screenshot"] |
| 73 | +image::images/blocklist/-management-admin-blocklist.png[] |
| 74 | + |
| 75 | +[discrete] |
| 76 | +[[edit-blocklist-entry]] |
| 77 | +=== Edit a blocklist entry |
| 78 | + |
| 79 | +You can individually modify each blocklist entry. You can also change the policies that a blocklist entry is assigned to. |
| 80 | + |
| 81 | +To edit a blocklist entry: |
| 82 | + |
| 83 | +. Click the actions menu (image:images/icons/boxesHorizontal.svg[Actions menu icon]) for the blocklist entry you want to edit, then select **Edit blocklist**. |
| 84 | +. Modify details as needed. |
| 85 | +. Click **Save**. |
| 86 | + |
| 87 | +[discrete] |
| 88 | +[[delete-blocklist-entry]] |
| 89 | +=== Delete a blocklist entry |
| 90 | + |
| 91 | +You can delete a blocklist entry, which removes it entirely from all {elastic-defend} policies. This allows end users to access the application that was previously blocked. |
| 92 | + |
| 93 | +To delete a blocklist entry: |
| 94 | + |
| 95 | +. Click the actions menu (image:images/icons/boxesHorizontal.svg[Actions menu icon]) for the blocklist entry you want to delete, then select **Delete blocklist**. |
| 96 | +. On the dialog that opens, verify that you are removing the correct blocklist entry, then click **Delete**. A confirmation message displays. |
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments