Application behavior recording and control

There are two ways to partially or fully automate application behavior control.

1. Using a reference computer

   You can easily track and learn background actions, such as access from applications, running programs, or written files, with the help of behavior recording. The results of this recording can be stored in a file.

   • On a reference computer, enable application behavior recording for one or more applications using the Agent remote control functionality.
   • You will then work with these applications, making sure that all important actions are performed, especially updates and configuration changes. This involves recording the behavior of the applications, such as determining which files are written and which other programs are started.
   • Then you can generate application behavior rules from the recorded data.

2. Automatic learning on individual DriveLock Agents

   • With an application collection rule, you can specify that the behavior of an application is restricted to the actions that are learned during a learning phase. In this case, only the access modes Execute, Load DLL and Write file are supported.

   • During a learning phase, the system learns how the application behaves and after completing the learning phase, any deviating behavior will be blocked.