Rules
      Back to home
      1. Vali Cyber Knowledge Base
      2. ZeroLock®
      3. Rules

      Recommended Ruleset

      The ZeroLock® Management Console (ZMC) includes a set of default Lockdown rules to ensure security.  Many known exploits are covered within this “Recommended Rules” ruleset and outlined in the rule's description.

        This Recommended ruleset is automatically added to the database when you first install the ZMC.   The ruleset is protected and may not be changed but may be copied, allowing you to create and modify a ruleset based on your organization’s particular requirements.  

        Order Matters

        The Recommended Ruleset is of the Ordered Rule type, meaning that Lockdown rules (File Access, Network Access, and Program Execution) are evaluated top-to-bottom, with rules on top resolving actions before moving on to later rules down the chain.

        Similar to a firewall, if an action matches a lockdown rule that is at the top of the list, it will take the actions specified for that rule and NOT evaluate any rules below it. If the action does not match that rule, it will continue to the next rule in line until it matches a rule. If no rules match the action, then the action is allowed.

        For the provided Recommended Ruleset, the rules are written so they do not overlap in any way that is consequential to the order they are in, so the default order is sufficient.

        Updating the Recommended Ruleset

        The rules contained in the Recommended Ruleset are versioned so determining if a rule in your ruleset is out of date is simply a matter of looking at the rule’s detail and comparing versions.  If a rule in your ruleset is out of date, you may download the latest ruleset json from the support site and import the newer rule which will automatically replace the out of date rule.

        This is done in the following manner:

        1. Download the latest rule set from the Vali Cyber support site for your server release. Server versions will identify the compatible ruleset downloads. For example, if you are running server 1.4.34, the agreeing ruleset json will appear like 1.4.1.x.
        2. Navigate to the Control Policies | Rules page | Actions drop-down and select Upload New   Rules. 
          Upload New Rules 2.0.1
        3. Open the ruleset json file you downloaded from the support site.New Ruleset 2.0.1
        4. On opening the file, the new ruleset will be uploaded to the ZMC, updating the changed rules. You can identify any revised rule by the version number located on the upper right of the Policy Rule details page.New Rule Version 2.0.1

        Note:  The details page for a rule is accessed by clicking on the rule.

        Adding Recommended Ruleset to a Policy

        Instead of adding individual rules, only the Recommended Ruleset is required.  This ensures that the rules are added to a policy in the correct order to properly protect the endpoint system. An easy way to add all Recommended rules to a policy is by the following steps:

        1. Create a Policy. Navigate to the Control Policies | Policies page.  Once there select Add New Policy.
          Add Policy Homepage 2.0.1-1
        2. On the New Policy pop-up menu, give your new policy a name and description. To add the recommended ruleset, click the Add Rules button.
          Recommended Ruleset Add Rules Page 2.0.1
        3. On the Policy Rules menu, scroll down the list of rules to Recommended Rules. Select this ruleset then click the Add Selected button.  
          Rule List Recommended Selected 2.0.1
        4. On the screen that follows, your lockdown rules section will now include the Recommended Rules.  Select CREATE on that screen.
          Recommended Ruleset Create Page 2.0.1
        5. Once created, your new policy will appear in the Policies section.  
          Recommended Ruleset Applied 2.0.1

        Applying Policy to Configuration Profile

        1. In order to apply a policy to an endpoint, the policy must first be applied to a Configuration  Profile. Navigate to the System Configuration | Config Profiles page then select  Add New Profile.Config Profiles Add New Profile Page 2.0.1

        2. On the New Configuration Profile pop-up menu, you can configure exactly what actions ZeroLock will take for each protection engine. Here, settings can be fine-tuned for Ransomware, Cryptojacking, and Tampering protection, as well as settings for all Hash Rules set to deny based on a SHA-256 hash.New Config Profile Clean 2.0.1
        3. In order to apply the policy that was created, navigate to the Default Control Policy drop-down menu, and select the preferred policy. Only one policy may be applied to a Configuration Profile at a time. Once complete, select the Create button at the bottom of the menu.  New Config Profile Selecting Recommended Rules 2.0.1-1

        Applying Configuration Profile to an Endpoint

        1. Once a Configuration Profile has been created, it must be applied to an endpoint for the settings to take effect. Navigate to the Endpoints page.
          Endpoints Page 2.0.1
        2. On the Endpoints page, select the endpoint or multiple endpoints that you want to apply the new configuration profile to. Then, click the Actions drop-down menu and select Set Endpoint Config.
          Select Set Endpoint Config Dropdown 2.0.1
        3. On the Set Endpoint Configs pop-up menu, select the created configuration profile from the drop-down menu. Then select the Set Configs button.
          Set Endpoint Config 2.0.1-2
        4. Your endpoint are now properly configured with the Recommended Ruleset.Policy Applied to Endpoint 2.0.1