Editing and Deleting File Rules

You can modify or delete an existing File rule.

To edit an approval or ban rule, on the Files tab of the Software Rules page, click the View Details button next to the rule. Edit the details you want to change. You can change all rule parameters except for Type (hash or file), Hash Type, and Hash Value. Source and History are read-only fields that reflect activities related to the rule. See File Rule Parameters; some parameters can be changed and some parameters are read-only. When you have finished making changes, click Save. The rule is updated.

Note:

You cannot disable an existing approval or ban, but you can change the Rule Type. For example, you can change a ban from an active ban to Report Only, which will prevent it from blocking but still report file executions it would have blocked.

You also can change a Ban to an Approval or vice versa. If you do not want a rule enabled in any way, you must delete it.

To delete a File rule, you can use the Remove Approval or Ban commands on the Action menu of any file table page, or the appropriate Remove command on a details page. If you are on the Software Rules page Files tab, select the check box next to the approvals and bans to delete, click the Delete File Rule button, and in the confirmation dialog box, click OK. The rules are removed.

You also can delete a single approval or ban by clicking the Remove Rule button on its Edit Rule page.