Application Process Control Overview

Create a whitelist policy.

A whitelist policy specifies how HSS learns server behaviors and protect application processes. Application process protection can be enabled only for servers associated with a whitelist policy.

Confirm learning outcomes.

After the HSS learns the application processes on servers, there may be some suspicious application processes with insignificant characteristics, and HSS cannot determine whether they are malicious or trustworthy. In this case, you need to confirm the learning outcomes.

Enable application process control.

Enable application process control on the servers associated with a policy.

Check and handle suspicious processes.

HSS cannot determine whether some suspicious application processes with insignificant characteristics are trustworthy. You need to check their process details, determine whether they are trustworthy, and add them to the process whitelist.

Check and handle malicious process alarms.

HSS reports an alarm once it detects a malicious process. Choose Detection & Response > Alarms, check and handle the alarms on the Server Alarms tab page, and clear malicious processes in a timely manner.

(Optional) Add items to the process whitelist.

After HSS completes learning, if you think the number of application processes it learned is fewer than the number of process fingerprints collected by the asset fingerprint function, or if it regarded many trustworthy application processes as suspicious, you can extend the HSS process whitelist. HSS will compare the application processes it already learned with the collected process fingerprints to enrich the HSS application process intelligence library and extend the trusted process whitelist.

(Optional) Start learning on the servers again.

If you have added trustworthy processes to the whitelist but there are still many false positives reported, you can let HSS start learning again on the servers.