Create a

CylancePROTECT Desktop

test policy

In the

File Actions

tab, in the

Auto Upload

section, select all the file types that are available.

Click

Create

to create the initial test policy.

Assign the initial test policy to the

CylancePROTECT Desktop

endpoints that you are using for testing.

Allow the devices that are assigned to the test policy to run for at least one day to allow applications and processes that are typically used on the device to run and be analyzed. You may want to consider any required applications that run periodically on a device (for example, once a week) that may need to be monitored outside of this test run.

While testing the policy, navigate to the

Protection > Threats

screen in the management console to view a list of applications and processes that

CylancePROTECT

considers to be a threat (abnormal or unsafe) and identify the ones that should be allowed to run on the endpoint. You can click a threat to view more information about it and download the malicious file to perform your own threat research. The malicious file is unaltered but renamed using the SHA256 hash without a file extension to prevent the accidental detonation of it. If you rename it to include the original file extension, the malicious file may be run. No personally identifiable information is shared with the console or with other tenants or organizations.

Navigate to

Policies > Device Policy

and edit the device policy to allow specific applications and processes to run on endpoints that have this policy assigned to them. You can add files to the

Policy Safe List

section in the

File Actions

tab.

In the

Protection Settings

tab, enable the

Background Threat Detection

setting and select the

Run Once

option. Although periodic scanning is not necessary due to the predictive abilities of the solution, you may select

Run Recurring

to enable it, for example, for compliance purposes.

Enable the

Watch For New Files

setting. This setting may negatively impact performance on the device. Adding folder exclusions may help reduce the impact.

To exclude specific folders from background threat detection, select

Exclude Specific Folders (includes subfolders)

and specify the folders to exclude. To allow the execution of files in the folders that you specified, select

Allow execution

. For more information about these fields, see Device policy: Malware Protection settings.

Click

Save

to save the policy.

Test the policy again and make sure that any applications that users are required to use are allowed to run. Background threat detection scanning may take up to one week, depending on how busy the system is and the number of files that require analysis. If necessary, make sure to add files to the policy safe list, global safe list, or waive them for individual devices. You can also exclude the folder containing the file in the protection settings.

In the

Protection Settings

tab, enable the

Kill Unsafe Running Processes

setting. 

In the

File Actions

tab, under the

Unsafe

table column, enable the

Auto Quarantine

setting beside

Executable

to automatically move unsafe files to the quarantine folder on the device. Unsafe files have malware attributes and are likely to be malware.

Under

Abnormal

, enable

Auto Quarantine

to automatically move abnormal files to the quarantine folder on the device. An abnormal file has fewer malware attributes than an unsafe file and is less likely to be malware.

In the

Memory Actions

tab of the device policy, enable

Memory Protection

and set the violation types to

Alert

. When a violation type is set to alert and a threat of that type is detected, the agent sends information to the console but does not block or terminate any processes running in the device memory.

While testing the policy, navigate to the

Protection > Memory Protection

screen in the console to view a list of memory protection alerts for processes may be a threat.

If you determined that any of the processes are safe for daily business activities, you can add exclusions for the processes that you want to allow to run. In the

Memory Actions

tab of the device policy, click

Add exclusion

and specify the relative path to the file.

After you have specified the exclusions for processes that you want to allow to run, set the action to

Block

for all violation types. When a violation type is blocked, the agent sends information to the console and blocks the malicious process from running in the memory. The application that called the malicious process is allowed to continue to run.

In the

Device Control

tab of the device policy, enable the

Device Control

policy.

Set the access level for each of the USB device types to

Full Access

.

Save the policy.

On the test device, insert a USB device.

In the management console, navigate to

Protection > External Devices

and identify the vendor ID, product ID, and serial number of any devices that you want to allow. Not all manufacturers use a unique serial number with their products; some manufacturers use the same serial number for multiple products.

In the

Device Control

tab of the device policy, in the

External Storage Exclusion List

section, click

Add device

to add any devices that you want to allow.

Once testing is complete, set the access level for each of the device types to

Block

. You can add any exclusions as needed.

In the

Script Control

tab of the device policy, enable the

Script Control

policy.

Set the policy for each of the script types to

Alert

. The longer the time script control is set to alert, the more likely you are to find infrequently run scripts used in the organization.

Navigate to

Protection > Script Control

and identify the scripts that were run on devices that you want to allow.

In the

Script Control

tab of the device policy, in the

Exclude Files, Scripts or Processes

section, click

Add exclusion

and specify a relative process path of the scripts that you want to allow (for example,

\Cases\AllowedScripts

).

After you have added the exclusions for scripts that you want to allow to run, you can set the policy for each of the script types to

Block

.