Create Endpoint Application elements

Create Endpoint Application elements by defining the details of the applications used on the endpoints.

  For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Select Configuration.
  2. Browse to Other Elements > Endpoint Information > All Endpoint Applications.
  3. Right-click All Endpoint Applications, then select New Endpoint Application.
  4. Define the properties of the Endpoint Application element.
  5. (Optional) To categorize the element with a Tag, click the Tags tab.
    1. Select Add Tags > Endpoint Application Usage.
    2. Browse for the Tag you want to use, then click Select.
  6. Click OK.

Endpoint Application Properties dialog box

Use this dialog box to define Endpoint Application properties.

Option Definition
General tab, when the element is a system element
Name The name of the element.
Description A description of the element.
Correlation Shows the factors used to identify the application.
Supported Engine Version Shows the versions of the NGFW Engine that are supported.
Category

(Optional)

 Includes the element in predefined categories. Click Select to select a category.
Comment

(Optional)

 A comment for your own reference.
Option Definition
General tab, when the element is a custom element where Identified By is Signer Information
Name The name of the element.
Identified By
  • Signer Information — The application is identified by the signer of the executable.
  • List of Executables — A list of executables is used for matching. You can import a list of executables.
Signer Name The signer of the executable.
Product Name The name of the application.
Product Version The version of the application. You can use a regular expression to match against multiple versions.
File Name The original name of the executable file, as reported by the file.
Category

(Optional)

 Includes the element in predefined categories. Click Select to select a category.
Comment

(Optional)

 A comment for your own reference.
Option Definition
General tab, when the element is a custom element where Identified By is List of Executables
Name The name of the element.
Identified By
  • Signer Information — The application is identified by the signer of the executable.
  • List of Executables — A list of executables is used for matching. You can import a list of executables.
List of Executables table Shows the executables that are used for matching. Click Add to add an element to the table, or Remove to remove the selected element. Click Edit to edit the properties of an executable.
Import Allows you to import an XML containing multiple executables. For more information on creating the XML file using the NGFW ECA Executable List Tool, see the Executable List Tool Guide.
Category

(Optional)

 Includes the element in predefined categories. Click Select to select a category.
Comment

(Optional)

 A comment for your own reference.
Option Definition
Tags tab
Tags table Shows the Tags associated with the element. To add a Tag, click Add Tags. It is not possible to create Tags. If the element is a system element, you cannot edit the associated Tags.

ECA Executable Properties dialog box

Use this dialog box to define ECA Executable properties that are used in Endpoint Application elements.

Option Definition
MD5 Hash The MD5 hash of the executable.
SHA256 Hash The SHA256 hash of the executable.
Product Name The name of the application.
File Name The original name of the executable file, as reported by the file.
Product Version The version of the application.