Application ControlNew
LimaCharlie Application Control decides which programs may run on Windows and macOS endpoints, and the LimaCharlie sensor enforces that decision at the moment a program starts. Write an allowlist or a blocklist, watch what it would block, and turn on blocking when the reports go quiet. Because it runs inside the sensor you already deploy, every decision becomes an event, the same as all other telemetry in LimaCharlie, so a blocked program sits next to the process tree, network activity, and detections that explain it instead of in a separate console.
Subscribe and scope a policy
Subscribe to Application Control in the Add-Ons marketplace. Subscribing changes nothing on an endpoint until a policy matches it. A policy selects sensors by operating system and by tag, and each sensor follows the first enabled policy that matches it. The stance sets the default: an allowlist denies any program no rule allows, and a blocklist allows any program no rule denies. Software signed by Microsoft or Apple can be trusted so the operating system keeps working.
Write rules that survive updates
Rules allow or deny a publisher’s signature, a file path, a single file by SHA-256 hash, or a macOS signing identifier. Signer rules are the preferred kind because they keep matching when software updates itself. A deny rule always wins. Wherever the console shows a file hash, Block with Application Control creates a deny rule for that exact file.
Start in a mode that cannot block
Audit mode reports what the policy would block and blocks nothing. Rehearsal runs the full blocking path and then allows the program anyway, the last check before enforcing. Observations lists every judged program as Would block or Blocked, and Allow turns an observation into a rule, shows the rule before writing it, and warns when a signer rule would trust a lot of software. A readiness card counts what the policy would block if it were enforced today.
Roll out by tag
A broad policy audits every machine, a pilot tag rehearses, and a smaller tag enforces. Moving a machine between stages, or stepping it back, is a tag change. Under an allowlist, a trusted installer rule names a self-updating program’s updater, and the sensor trusts the processes it starts and the files it writes. Those files are recorded by digest, so a copy keeps the trust and a modified file loses it.
Detect and respond on every decision
Each block or would-be block is an event carrying the file path and hash, signer, matched rule, parent process, and user. Repeats of the same verdict within five minutes fold into one summary event with a count, so one noisy program does not flood your detections. D&R rules treat these like any other event: report every would-be block grouped by signer, or raise a detection when a program is blocked on a server that should never run anything new.
Contain a host without cutting it off
Lock down host contains a machine during an incident. Programs the lockdown policy refuses are stopped and new ones are blocked, while the host keeps its network connection so the investigation can continue. A D&R rule can request lockdown automatically by adding a tag.
Install software without switching the policy off
Install mode gives one host, or a selection of hosts, a window of one hour up to a week in which Application Control only reports. Install or update software, review what ran, and the host returns to its normal policy when the window ends. When a program is blocked, the user can get a desktop notice saying so, with an optional tray icon that keeps a history of blocks, so they learn what happened from the machine itself before they open a ticket.
Manage everything as code
Policies and rules are Config Hive records, so the API, the LimaCharlie CLI, and Git Sync manage them the same way they manage the rest of your deployment. An AI agent working through the CLI reaches Application Control with the same permissions as any other caller, alongside EDR, Cloud Security, Code Security, and Email Security.
Compliance evidence
One export bundles policies, rules, enforcement coverage, and observations into a single archive with a PDF report and CSV files. Controlling program execution on Windows and macOS partially covers CIS Controls v8 2.5, the Essential Eight application control strategy, and NIST SP 800-53 CM-7(5). The report states what falls outside that coverage.
Built for service providers
Each client is its own LimaCharlie organization with its own policies, rules, and audit trail. Package a baseline of publisher rules and staged policies as code, deploy it to every client organization, and adjust per client with rules scoped to that client’s policies. Onboarding a client to allowlisting becomes a subscription and a policy, and the client’s block events land in the same detections and cases your analysts already work.
What it costs
Application Control is listed at $0.40 per sensor and billed through the same LimaCharlie account as the rest of the platform. It runs in the sensor you already deploy, so there is no second agent to install or pay for.
Where it sits
Application Control judges a program when it starts, on Windows and macOS, and requires sensor version 5.4.0 or later. Linux is not supported. Scripts, DLLs, and MSI packages are outside its control, so it is one control among several, alongside D&R rules and EDR telemetry.
Subscribe in the Add-Ons marketplace and create your first policy in Audit, or walk through it with a solutions engineer.
Start freeBook a demo