Administrators can use Apex Central Logs Query and Application Control Widgets to identify applications with False Alarm detections. To do this:

• Detection Logs
  1. Log on to the Apex Central console and go to Detections > Logs > Log Query.
  2. Change the Security Logs to “Application Control Violations”.
  3. Select the time range (e.g. 24 hours) and click the Search button.
   

  • Use Advanced Search to narrow down the list of displayed logs.
  • Use the Customize Columns to add/remove columns and help you easily identify False Alarm applications.
  • Export the result as CSV to easily filter the result in a spreadsheet.

   
• Dashboard
  1. Log on to the Apex Central console and go to Dashboard.
  2. Click + to add a new tab.
  3. Add the “Top Violated Application Criteria” and “Top Blocked Applications” widgets.

After successfully identifying allowed applications with False Alarm, Administrator can fine-tune the Application Control policy by adding or editing existing Allow criteria to enable blocked applications to run. To do this:

1. Configure Allow criteria.
   • If the Allow criteria is using the Certified Safe Software List Match Method, make sure to include all the version of the allowed application. For instance, if you intend to allow OfficeScan Agent and all future releases, tick the checkbox beside the Trend Micro OfficeScan Agent application name.

     

   • Configure the Allow criteria with Trust permission set to at least “Application can execute other processes” trust level.

     

    

   To instantly allow the False Alarm application(s), add an Allow criteria with a “Hash values” Match Method to manually add SHA-1 or SHA-256 hash values of the blocked application.

   

    

   Reference: Defining Allowed Application Criteria

2. Deploy Allow Criteria:
   1. Log on to the Apex Central console and go to Policies > Policy Management.
   2. Select Product "Apex One Security Agent".
   3. Edit the Policy with Application Control enabled.
   4. Expand the Application Control Settings and click the corresponding User Account to assign the newly created Allow Criteria.
   5. Click Deploy.