Controlling access to files

An application identifier must be created beforehand for applications that are allowed to access files and for those that you want to block. For more information, refer to the section Creating application identifiers.

1. Select the Security > Policies menu and click on your policy.
2. Select a rule set.
3. Click on the ACL resources > File tab.
4. If you are in read-only mode, click on Edit in the upper banner.
5. Click on Add > Rule (Files).
   A new line is displayed.
6. Click on in the area on the left to show the window where IDs of restricted access files are created.
   - And/or -
   Click on the icon to display the window for creating the identifier of the file(s) you wish to exclude from access control.
7. Enter the ID name.
8. Enter a file, path or extension. The generic characters "?" and "*" are allowed in this field.
   Full paths beginning with a letter (i.e., E:\Data\Backup) are not supported if the Volume type is remote or removable.
   Stormshield strongly recommends the use of EsaRoots path roots provided by SES Evolution instead of drive letters (i.e., C:\...). In fact, these letters may differ from one workstation to another.
   

   NOTE
   You can enter a path that contains the letter of a local hard disk or SSD drive in this field. However, if users change the letter of the drive or add one, you must restart the workstation or modify the policy that the agent applies so that the drive can be detected.

9. Choose the type of volume on which the file or file type is located.
10. You can specify the Windows account that owns the files in advanced settings, provided that these files are located on a local volume. You can also manually enter a Security ID (SID) to indicate a personal Windows account. This option makes it possible to allow or prevent access to files hosted on certain accounts.
11. You can also specify an alternate data stream. A file’s alternate data stream contains metadata and makes it possible to find out the origin of the file. For example, by specifying the alternate data stream "zone.identifier", rules can be created for files originating from the Internet. The alternate data stream can also be an attack vector by harboring malicious code. The generic characters "?" and "*" are allowed in this field.
12. Click on OK to close the ID creation window. Scroll over the name of the ID to see a summary of the settings.
13. In the Default behavior field, select a behavior from among those available for this type of rule: :
    • Allow to allow the action by default,
    • Block to block the action by default,
    • Block and kill to block the action by default, and shut down the process that launched the action.
    • Block, kill and quarantine to block the action by default, kill the process that triggered the action, and quarantine suspicious files. For more information, see the section Managing file quarantine.
    • Ask for the user to be consulted.
    • Skip behavior to ignore the subrule if the behavior is detected and move on to the next behavior.
    • Skip rule to ignore the rule contained in this rule set and evaluate the next rule.
    • Skip rule group to ignore the rules contained in the rule group and evaluate the next rule group or rule.
    • Skip rule set to ignore all the rules contained in this rule set and evaluate the next rule set.
14. Click on + Add specific behavior and choose the resource(s) that you want to exclude from the default behavior. Select the behavior for each case.

EXAMPLE
Block the ability to modify or delete Office files and other sensitive files by default. Allow these actions only for legitimate applications.

15. In the upper banner in the rule, you can:
    • If necessary, rearrange the order of the rules by clicking on when the cursor hovers the rule. Each rule displays its line number in the banner.
    • Disable rule. For more information, refer to the section Disabling security rules.
    • Indicate the intent of the rule, according to predefined categories:
      

      • Unclassified: unclassified rule.

      • Nominal: non-blocking rule conforming to nominal application behavior.

      • Protect: blocking rule with a high log severity level.

      • Protect silent: blocking rule with a severity level below the log thresholds displayed by default on the agent and console. Protects access to resources deemed sensitive, even if carried out by programs with no malicious intent. As there may be many such programs, a rule with too high a log severity could trigger massive log generation.

      • Detect: non-blocking audit rule or passive rule.

      • Context: rule used to build an attack graph.

      • Syslog: rule triggering logs sent exclusively to a Syslog server.

      • Watch: rule for monitoring behavior in order to fine-tune the security policy or gain a better understanding of technical events occurring in the pool.

      Selecting one of these categories has no influence on rule configuration. They simply enable the administrator to classify their security rules according to their purpose, and sort them using the dedicated Rule intent filter. The rule intent is also displayed in the log details.
      
    • Enter a description to explain what this rule aims to achieve.
    • Make the rule passive. Passive rules behave like standard rules but do not actually block any actions. The agent only generates logs that indicate which actions security rules would have blocked.
      Use this mode to test new restriction rules, determine their impact, and make the necessary adjustments before disabling Passive rule mode. For further information on testing rules and policies, refer to Testing security policies.
    • Indicate whether the rule must generate a context when it is applied. By default, if a rule generates Emergency or Alert logs, it will generate a context, but you can disable this feature. In case of mass generation of similar logs, the context is not generated. For more information on mass log generation, refer to the section Monitoring SES Evolution agent activity.
    • Adding a comment.
    • Select the log settings that this rule will send.
    • Specify whether an action must be performed when a log is sent for this rule. You can request that a script be run and/or that a Yara or IoC scan be triggered. You can also request that a notification be displayed on the agent, provided that it is associated with a an Alert or Emergency level blocking log.
    • Deleting the rule.
16. Expand the Classification in logs part to indicate the intent of the suspected attack when the rule applies, along with the tags for associating the rule with the MITRE repository. This information is then visible in the logs generated by the rule. For more information, see Classifying attacks according to the MITRE repository.
17. Click on Save at the top right of the window to save changes.