You can create an approval or ban rule from the Files page (File Catalog or Files on Computers) and any other console page that lists files, including pages in which the file is not the primary object. Generally, a row with a check box next to a filename allows creation of bans and approvals from the Action menu:
- Files page (both File Catalog and Files on Computers)
- Baseline Drift Report Results pages that list files
- Snapshot Content page
- Events page (only events that include file hashes)
- Find Files page (when showing results)
The Action menus on table pages provides the following choices for managing approvals and bans:
- Approve Globally
- Immediately creates a hash-based rule globally approving a file for all computers – no configuration is necessary.
- Ban Globally
- Immediately creates an active hash ban applying to all computers – no configuration is necessary.
- Approve by Policy
- Opens the Add Rule page with the file name as Rule Name, Approval as the Rule Type, and the file Hash already in place. You can apply the rule to selected policies or all computers and you can edit the rule name and add a description.
- Ban by Policy
- Opens the Add Rule page with the file name as Rule Name, Ban as the Rule Type, and the file Hash already in place. You can apply the rule to selected policies or all computers, you can edit the rule name and add a description, and you can make the rule an active ban or a report-only ban.
- Remove Approval or Ban
- Immediately removes the rules for all checked boxes, including mixed selections of approvals and bans.
The advantage of creating an approval or ban from a console files table is that you can approve or ban multiple files at the same time.
When you create a rule from a table, the rule definition you provide applies to each selected file. When you save the definition, a separate rule is created and named for each selected file. Rules created from selected rows of a table are always hash bans that use SHA-256 hashes if available.
- Initially, files that originate from a common source or installer are grouped under the source or installer file name. If you are searching for a file to approve or ban and want to include all individual files grouped under an installer in the table, select the Show Individual Files check box in the lower right corner of the Files page. This action automatically refreshes the table.
- You can filter the lists of files on the Files page, rearrange display columns, and download results in comma-separated-value format. For more information, see Console Tables in Using the Console
