New at Securepoint: 10.2026
Terms
Application Control Appliance
Application Control Appliance refers to the VM with the server database that contains the allowlist
Agent/Client
Agent refers to the agent software that runs on each device to be protected. As many agents can be installed as licenses have been purchased. The agents connect to the Application Control Appliance, making them clients as well
AdminWizard
The AdminWizard is the management GUI software for administrators to manage the entire Application Control
Devices
Application Control can recognize and manage all USB devices based on their vendor and product ID (VIDPID). This can be configured in the Client configuration of the AdminWizard. An unknown device will not be allowed, regardless of its device class. This applies, for example, to keyboards as well. If the distinction of devices by serial number is configured, this only applies to USB mass storage devices. Non-mass storage devices are managed only via VIDPID, even with the "Distinction by serial number" setting. Since USB devices are not managed in the TLDB, an agent installation in learning mode must be performed to avoid blocking USB keyboards and mice when USB device checking is enabled.
Active Directory Objects
Rules can refer to Active Directory (AD) objects. To replicate these from the AD, click on Menu Extras / Update Active Directory Objects. Your Active Directory (AD) contains information about security groups, computers, and users that can be used by Application Control as reference objects for individual policies. After replication, actions that refer to hashes can now relate not only to IP addresses but also to AD objects of the type User, Computer, or Group. The AD objects are stored in the allowlist. This process can be performed automatically via the Adding automatisms.
Classifications
For better management, hashes can be assigned a classification. This is a free text field that does not influence whether a hash is allowed or rejected; it is only intended to improve structuring and clarity for the administrator. The semicolon in the free text defines a separation of levels.
The hash with the classification Tools;Google;Chrome;73.0.3683.75 will later be found under Root> Class> Tools> Google> Chrome> 73.0.3683.75
Signatures
Application Control can automatically add unknown software to the allowlist if it is electronically signed (Authenticode). To do this, the administrator can add signatures from manufacturers whose software they want to automatically trust via drag and drop of a signed file in the AdminWizard. (Checkbox "Add signature manufacturer")
TrustLevel Database Service (TLDB)
We operate a redundant cluster of a cloud-based database containing hashes of trustworthy software in German data centers. The trustworthiness of a hash is evaluated using so-called TrustLevels. The TrustLevel database is maintained exclusively by our employees and provides a good TrustLevel for over 99% of requests. Under the "Learning Sources" tab, a minimum TrustLevel threshold can be set. If a hash is not known in the local allowlist, it is queried in the TrustLevel database. If the TrustLevel of the hash in the TrustLevel database is at least as high as the set threshold, the hash is automatically added to the allowlist as allowed. In this way, the Application Control System automatically learns trustworthy software without requiring manual intervention from an administrator.
TrustLevel in the local allowlist
In the local allowlist, the TrustLevel is metadata that can be attached to a hash. The TrustLevel has no influence on the admissibility of software.
TrustLevel in the TrustLevel Database (TLDB)
The TrustLevels used in the TrustLevel Database Service are assigned as follows:
| Trust Level | Explanation |
|---|---|
| 0 | Indicators suggest that this software may be potentially malicious. |
| 1-2 | Indicators suggest that this software is unsuitable in a business environment (e.g., revoked signature). |
| 3 | The software is either unknown, completely new, or there are as many indicators for a positive as for a negative classification of the software. |
| 4-10 | Indicators suggest that this is desired and trustworthy software. The higher the value, the stronger the indicators. |