Local learning

DriveLock Application Control provides a learning functionality to learn the behavior of applications on DriveLock Agents.

This is accomplished by enabling the client computer to enter learning mode and creating a local whitelist (hash database) of installed programs and DLLs. This individual local whitelist then contains the approved files that have been learned locally. Once the learning mode is completed, the local whitelist is activated and only the "learned" programs can be executed. To ensure that Application Control does not block programs that are installed or updated at a later time, you can temporarily reactivate the learning mode for the installation or update

You can activate local whitelisting either by configuring the Local whitelist and predictive whitelisting setting or by creating a Predictive Whitelisting rule.

Local learning is triggered

• by specifying the corresponding learning settings in an application list rule or
• by using an application behavior rule that was automatically created from an application behavior recording.

When the local whitelist is activated, you can define additional settings to configure the learning functionality.

The local whitelist is merged incrementally with the application database on the DriveLock Enterprise Service (DES). When you create file properties rules, you can also select from this global application database.