Technical Tip: How to confirm which entry a blocked application is matching in Application Control Manager
| Description | This article describes how to determine which entry a blocked application is matching in Application Control Manager. |
| Scope | FortiEDR. |
| Solution | Raw events can be exported in JSON format to determine by which criteria an application is matching an entry in Application Control Manager.
In the following case, Wireshark was blocked by Application Control:
Closer inspection of the relevant raw event reveals that the application matched a hash in Application Control Manager:
The matched hash can be searched for in Application Control Manager:
|
