Software Policies

What are Software Policies?

Software Policies allow you to define security rules for software, processes, and network connections across your organization. These policies determine what software is permitted, prohibited, or requires monitoring.

Why Use Software Policies?

• Enforce Security Standards: Block known malware and unauthorized software
• Compliance Requirements: Document approved software for audits
• Risk Reduction: Identify high-risk applications before incidents occur
• Automated Response: Configure actions from alerting to quarantine

Accessing Software Policies

1. Navigate to Security in the main menu
2. Select Software Policies
3. View the policy list with filters and search

Understanding the Policy List

The policy list displays all configured security policies:

Column	Description
Name	Product or malware name
Type	Blacklist or Whitelist
Severity	Critical, High, Medium, or Low
Action	What happens when detected
Status	Active or Inactive
Source	Manual or Threat Intelligence feed

Creating a New Policy

From Software Catalog

1. Click Add Policy
2. Select From Catalog option
3. Search for the software
4. Configure policy settings:
   • Severity: How critical is this threat?
   • Action: Alert, Block, Quarantine, or Monitor
   • Reason: Why is this policy needed?
5. Click Create

Manual Entry

For malware or threats not in the catalog:

1. Click Add Policy
2. Select Manual Entry option
3. Enter:
   • Product Name: Name of the software/malware
   • Vendor: (Optional) Software vendor
   • Description: Why this is being blacklisted
4. Configure severity and action
5. Click Create

Policy Settings

Severity Levels

Level	Description	Response Time
Critical	Active malware, ransomware, APT tools	Immediate
High	Known threats, C2 frameworks	Within 1 hour
Medium	Potentially unwanted programs	Within 24 hours
Low	Policy violations, unauthorized software	Scheduled review

Actions

Action	Behavior
Alert	Create event, send notification
Monitor	Log detection without alerting
Block Install	Prevent new installations
Quarantine	Isolate affected systems
Uninstall	Flag for removal

Reasons

• Malware: Known malicious software
• Security Risk: Vulnerability or exposure risk
• Compliance: Regulatory requirement violation
• Unauthorized: Not on approved software list
• End of Life: Unsupported software version
• License Violation: Licensing compliance issue

Policy Details

Click on any policy to view detailed information:

Basic Information

• Product name and vendor
• Policy type and severity
• Configured action
• Active/Inactive status

Detection Patterns

How the system identifies this software:

• Name Patterns: Regex patterns for software names
• Process Names: Known process executables
• File Paths: Installation locations

Threat Intelligence

For threat-sourced policies:

• Threat Type: Ransomware, Trojan, Botnet, etc.
• Aliases: Alternative names for the malware
• MITRE ATT&CK: Associated techniques
• References: External documentation links

Network IOCs

For malware with known infrastructure:

• Malicious IPs: Known command & control servers
• Ports: Common communication ports
• Domains: Malicious domain names

Exclusions

Prevent false positives:

• Excluded Vendors: Trusted software vendors
• Excluded Names: Specific software to ignore
• Legitimate Paths: Known-good installation paths

Viewing Violations

When a policy is triggered:

1. Open the policy details
2. Click View Violations
3. See all detection events:
   • Affected host
   • Detection time
   • Process/software details
   • Current status

Managing Policies

Edit Policy

1. Click the policy row
2. Modify settings as needed
3. Click Save Changes

Disable Policy

1. Open policy details
2. Toggle Active to off
3. Policy will stop triggering detections

Delete Policy

1. Open policy details
2. Click Delete
3. Confirm deletion

Note: System default policies from threat intelligence cannot be deleted, only disabled.

Best Practices

Policy Organization

• Use clear, descriptive names
• Set appropriate severity levels
• Document the reason for each policy
• Review policies quarterly

False Positive Management

• Add exclusions for known-good software
• Review Medium/Low severity detections regularly
• Document false positive patterns

Integration Tips

• Connect alerting to your notification channels
• Link policies to compliance frameworks
• Export policy list for documentation

Common Use Cases

Block Known Malware

Create a critical blacklist policy for known ransomware:

• Severity: Critical
• Action: Quarantine
• Reason: Malware

Monitor Shadow IT

Track unauthorized software installations:

• Severity: Low
• Action: Monitor
• Reason: Unauthorized

Compliance Enforcement

Ensure only approved software is installed:

• Create whitelist of approved software
• Alert on anything not in the whitelist
• Generate compliance reports

Related Topics

• Threat Intelligence - Understanding threat data
• Network IOC Scanning - Network monitoring
• Security Events - Responding to detections