Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

CSA First Time Application Execute

I created an Application control rule as follows:

Take the following action: Monitor

When Current applications in any of the following selected classes: <First Time Application Execute>

Attempt to run New applications in any of the following selected classes: <All Applications>

What I thought this rule would do is trigger an event when a NEW process was observed for the first time on a particular host. But I'm seeing repetitive events. Does the <First Time Application Execute> reset itself after a reboot? Is my rule set up wrong for the results I want - should I swap the classes; When <All Applications> attempts to run <First Time Application Execute> ?

2 REPLIES
Silver

Re: CSA First Time Application Execute

New Member

Re: CSA First Time Application Execute

I know what it says in the documentation, but what is supposed to happen is not what is actually happening.

97
Views
0
Helpful
2
Replies
CreatePlease to create content