{"id":3310,"date":"2026-08-12T06:10:56","date_gmt":"2026-08-12T06:10:56","guid":{"rendered":"https:\/\/zecurit.com\/help\/?post_type=docs&p=3310"},"modified":"2026-08-12T06:10:57","modified_gmt":"2026-08-12T06:10:57","slug":"creating-an-application-group-in-zecurit","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/creating-an-application-group-in-zecurit\/","title":{"rendered":"Creating an Application Group in Zecurit"},"content":{"rendered":"\n

An Application Group<\/strong> is a collection of applications that you want Application Control to manage. You can create a group using the product name, vendor, executable file, file hash, or folder path<\/strong>. After creating the group, assign it to a Deployment Policy<\/strong> to allow or block the selected applications.At least one Application Group must exist before you can create a Deployment Policy.<\/strong><\/p>\n\n\n\n

What is an Application Group?<\/h2>\n\n\n\n

An Application Group<\/strong> defines the applications that Application Control identifies on a device. The action taken for those applications, such as Block or Allow<\/strong>, is configured in the Deployment Policy<\/strong>. The same Application Group can be used with different policies for different devices based on the required action.<\/p>\n\n\n\n

Create Application Group<\/strong><\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
    \n
  1. Log in to the Zecurit portal<\/strong>. <\/li>\n\n\n\n
  2. Go to Endpoint Manager \u2192 Application Control<\/strong>. <\/li>\n\n\n\n
  3. On the Application Control<\/strong> page, select the Application Group<\/strong> tab.<\/li>\n\n\n\n
  4. Click Create Application Group<\/strong><\/li>\n\n\n\n
  5. Select the required Platform<\/strong>, such as Windows, Linux, or macOS<\/strong>. <\/li>\n\n\n\n
  6. Click + Add Application Group<\/strong> to open the application group configuration. <\/li>\n\n\n\n
  7. Enter the required group details and configure the application rules.<\/li>\n\n\n\n
  8. Click Add App List<\/strong> to save the application group.<\/li>\n<\/ol>\n\n\n\n

    Saved groups become available for selection when building a Deployment Policy.<\/p>\n\n\n\n

    Configuring Group Details<\/h2>\n\n\n\n
    Field<\/strong><\/th>Required<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
    Application Group Name<\/td>Yes<\/td>A descriptive, unique name (e.g., “Prohibited app – US Branch”). Use naming conventions that indicate scope or purpose, since this name appears later in policy and violation records.<\/td><\/tr>
    Access Type<\/td>Yes<\/td>Determines whether listed applications are blocked or the only ones permitted.<\/td><\/tr>
    Risk Level<\/td>No<\/td>Classifies the group’s severity for reporting and prioritization.<\/td><\/tr>
    Associate Rule<\/td>Yes<\/td>The actual application matching rules that define group membership.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Access Type: Block List vs. Allow List<\/h2>\n\n\n\n
    Access Type<\/strong><\/th>Behavior<\/strong><\/th>Typical Use Case<\/strong><\/th><\/tr><\/thead>
    Block List<\/td>Applications matching the group’s rules are denied; everything else is permitted<\/td>Blocking known risky, unlicensed, or non-business software (e.g., torrent clients, unauthorized browsers)<\/td><\/tr>
    Allow List<\/td>Only applications matching the group’s rules are permitted; everything else is denied<\/td>Locking down highly regulated or kiosk-style devices to a fixed software set<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Block List is selected by default and suits most general-purpose enforcement. Allow List is more restrictive and is typically reserved for high-security environments, since any application not explicitly listed will be prevented from running.<\/p>\n\n\n\n

    Risk Level<\/h2>\n\n\n\n

    Risk Level is a classification tag (Low, Medium, High) rather than an enforcement setting. It doesn’t change how the group is enforced, but it does:<\/p>\n\n\n\n

      \n
    • Appear in reports and dashboards to help prioritize review.<\/li>\n\n\n\n
    • Help other admins quickly gauge the sensitivity of a group without opening its rule list.<\/li>\n\n\n\n
    • Support filtering when auditing large numbers of application groups over time.<\/li>\n<\/ul>\n\n\n\n

      As a general guideline:<\/p>\n\n\n\n

      Risk Level<\/strong><\/th>Example Scenarios<\/strong><\/th><\/tr><\/thead>
      High<\/td>Malware-adjacent tools, unauthorized remote access software, unlicensed P2P\/torrent clients<\/td><\/tr>
      Medium<\/td>Consumer cloud storage apps, unsanctioned browsers, unmanaged VPN clients<\/td><\/tr>
      Low<\/td>Legacy internal tools being phased out, low-impact utilities under review<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Associating Rules<\/h2>\n\n\n\n

      Rules define exactly which applications belong to the group. You can build rules three ways:<\/p>\n\n\n\n

        \n
      • + Add New<\/strong>: manually create a rule using one of the match types below.<\/li>\n\n\n\n
      • Select from existing<\/strong>: reuse a rule already defined elsewhere in your organization, keeping definitions consistent across groups.<\/li>\n\n\n\n
      • Import CSV<\/strong>: bulk upload a list of applications, useful when migrating an existing block\/allow list from another tool or spreadsheet.<\/li>\n<\/ul>\n\n\n\n

        If no rules have been added yet, the group will show “No rules added yet” until at least one is created. A group with no rules has nothing to enforce.<\/p>\n\n\n\n

        Match Types Explained<\/h2>\n\n\n\n

        Rules can identify applications using any of five match types, available as tabs when adding a rule:<\/p>\n\n\n\n

        Match Type<\/strong><\/th>Matches On<\/strong><\/th>When to Use<\/strong><\/th><\/tr><\/thead>
        Product\/Software<\/td>The application or product name<\/td>Broadest match; blocks\/allows an app regardless of publisher-signed executable name or install location<\/td><\/tr>
        Vendors<\/td>The software publisher<\/td>Useful for blocking or allowing everything from a specific vendor at once<\/td><\/tr>
        Executable<\/td>The executable file name (e.g., chrome.exe)<\/td>More precise than product name; useful when the product name is inconsistent across versions<\/td><\/tr>
        File Hash<\/td>A specific file’s cryptographic hash<\/td>Most precise; targets an exact file\/version, ignoring renamed copies with different hashes<\/td><\/tr>
        Folder Path<\/td>The install or execution directory<\/td>Useful for blocking anything launched from a specific location, such as a USB drive or temp folder<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        Tip:<\/strong> Combine match types within a single group when needed. For example, match by Vendor to catch most releases, plus File Hash entries for specific flagged builds.<\/p>\n\n\n\n

        Example Application Groups<\/h2>\n\n\n\n
        Group Name<\/strong><\/th>Access Type<\/strong><\/th>Risk Level<\/strong><\/th>Match Type Used<\/strong><\/th><\/tr><\/thead>
        Prohibited app – US Branch<\/td>Block List<\/td>High<\/td>Product\/Software<\/td><\/tr>
        Approved Browsers – Kiosk Devices<\/td>Allow List<\/td>Low<\/td>Executable<\/td><\/tr>
        Unauthorized Remote Access Tools<\/td>Block List<\/td>High<\/td>Vendors<\/td><\/tr>
        Flagged Build – CVE Review<\/td>Block List<\/td>Medium<\/td>File Hash<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        Best Practices<\/h2>\n\n\n\n
          \n
        • Keep group names specific and self-explanatory, since they surface later in the Violations log.<\/li>\n\n\n\n
        • Start new block rules with Notify Only enforcement (configured at the policy level) before switching to Block Execution, to avoid disrupting legitimate workflows.<\/li>\n\n\n\n
        • Use File Hash matching for time-sensitive security responses (e.g., a newly identified malicious binary) rather than waiting to identify a stable product name.<\/li>\n\n\n\n
        • Periodically review Risk Level tags to ensure they still reflect current threat priorities.<\/li>\n<\/ul>\n\n\n\n

          Troubleshooting Tips<\/h2>\n\n\n\n
          Issue<\/strong><\/th>Resolution<\/strong><\/th><\/tr><\/thead>
          “No rules added yet” won’t clear<\/td>Add at least one rule via + Add New, Select from existing, or Import CSV before saving<\/td><\/tr>
          CSV import fails<\/td>Confirm the file matches the expected column format; check for missing required fields or malformed entries<\/td><\/tr>
          Group not appearing in Deployment Policy selector<\/td>Confirm the group was saved successfully with Add App List, not left in an unsaved draft state<\/td><\/tr>
          Wrong applications being matched<\/td>Review the match type used; Product\/Software matches are broader than Executable or File Hash<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

          <\/h2>\n\n\n\n

          <\/p>\n","protected":false},"featured_media":0,"parent":3309,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_is_vendor_doc":"0","footnotes":""},"doc_tag":[],"class_list":["post-3310","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3310"}],"version-history":[{"count":6,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3310\/revisions"}],"predecessor-version":[{"id":3353,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3310\/revisions\/3353"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3309"}],"next":[{"title":"Creating a Deployment Policy in Application Control","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/deploying-the-policy\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3319"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3310"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}