Agent control policies determine how agents run and what data agents can access on end-user devices. Create a policy to select the agents to control, choose the action to take, and define the users and devices that the policy applies to.
Policy types
Agent control policies are grouped into three types. Each type is configured on a separate tab and controls a different aspect of agent behavior on end-user devices:
Agent Disable Management — Restrict the agents that users can run on their devices.
Command Execution Control — Restrict the commands that an agent can run.
Data Access Permissions — Restrict the directories and sensitive information that an agent can access.
Limits
The data identification rules that you can select in a Data Access Permissions policy depend on whether the DLP module is enabled. If the DLP module is not enabled, you can select only the rules that apply to file content, which are described in Configure classification and grading detection rules for outgoing files.
Common parameters
The following parameters apply to all three types of Agent control policies. The parameter table in each of the following sections describes only the parameters that are specific to that policy type.
Parameter | Description |
Management Agent | Select the agents that you want to control. You can select multiple agents. |
Scope | The scope in which the policy takes effect. Specify the scope in one of the following ways:
|
Exception User | Select the users that the policy does not apply to. You can add multiple users. After you enter a user, press Enter to add the next one. |
Policy Status | Specify whether the policy takes effect. This parameter is turned on by default. |
Priority | Set the priority of the policy. A smaller value indicates a higher priority. If a device matches multiple policies, the policy with the higher priority takes effect. |
Configure an Agent Disable Management policy
Log on to the SASE console.
In the left-side navigation pane, choose Agent Office Security > Agent Control Policy.
On the Agent Disable Management tab, click Create Policy.
Configure the parameters described in the following table. For the parameters that all policy types share, see Common parameters.
Parameter
Description
Action
Select Block Startup or Prompt Only.
Prompt Display Configuration
Configure the pop-up message that appears when the device tries to use the specified agent. You can configure the message in Chinese and English.
Click OK to complete the configuration.
Configure a Command Execution Control policy
Supported in client version 5.2.7 and later.
Log on to the SASE console.
In the left-side navigation pane, choose Agent Office Security > Agent Control Policy.
On the Command Execution Control tab, click Create Policy.
Configure the parameters described in the following table. For the parameters that all policy types share, see Common parameters.
Parameter
Description
Action
Select Monitor or Block.
Command Type
The following command types are supported:
Built-in Command: the command set that the system provides. Turn on the switch on the right to select all built-in commands. You cannot select individual built-in commands.
Custom Commands: the commands that you define, which support Lua regular expression syntax.
Click OK to complete the configuration.
Configure a Data Access Permissions policy
Supported in client version 5.2.7 and later.
Log on to the SASE console.
In the left-side navigation pane, choose Agent Office Security > Agent Control Policy.
On the Data Access Permissions tab, click Create Policy.
Configure the parameters described in the following table. For the parameters that all policy types share, see Common parameters.
Parameter
Description
Mode
Set the mode in which the policy takes effect:
Blacklist: only the files and directories in File Scope Configuration, or the files that match the data identification rules, are restricted. All other files are not restricted.
Whitelist: only the files and directories in File Scope Configuration, or the files that match the data identification rules, are not restricted. All other files are restricted.
Action
Select Monitor or Block.
File Scope Configuration
Specify the file scope in one of the following ways:
Custom File Directory: add a Directory Path. To exclude a subdirectory from a large directory, add Excluded Directories.
Data Identification Rule: select the data identification rules to apply. Files that match the selected rules are included in the file scope.
Click OK to complete the configuration.