The Trellix Application Control Options policy must be configured to disable Self-Approval.
An XCCDF Rule
Description
<VulnDiscussion>The Trellix Application Control Self-Approval feature allows the user to take an action when a user tries to run a new or unknown application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-213336r944845_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
From the ePO server console System Tree, select the "Systems" tab.
Select "This Group and All Subgroups".
Select the asset.
Select "Actions".
Select "Agent".