Allowlisting control mode - Idemeum Docs

Allowlisting control modes

You can control how allowlisting behaves for each of your devices in idemeum. App control mode defines how idemeum agent behaves for rule enforcement and event collection.

Mode	Definition
Disabled	idemeum agent is not capturing any `execution` events and not enforcing any rules. User experience does not change on the workstation.
Audit	idemeum agent is capturing `execution` events and uploading them to the cloud periodically. However, agent is not applying any rules or interrupting execution or elevation flows.
Rules	Idemeum agent controls application `executions` and enforces the rules that you created in the portal. For allowlisting `default deny` policy is applied for untrusted applications. If the application is not explicitly allowed, it will not run.

Change allowlisting control mode

Navigate to your idemeum admin portal
Select Devices and search for the device you want to change the app control mode for
Click on ... then choose Set app control mode
Choose the mode and save the configuration

Bulk allowlisting control mode change

Navigate to your idemeum admin portal
Access Devices section and select multiple devices with check boxes
Click on the bulk change button at the top and choose Set app control mode
Choose the mode and save the configuration

Allowlisting eventsIdemeum tracks every execution across your workstations and represents each application as an event in the cloud.