Critical System Protection

Does SCSP have the ability to perform application profiling? We are considering bringing in a new app for our systems and I would like to know if there is wat SCSP can inspect the app to determine what files/dll/ & registry keys it requires access to and then open access based on that inspection. How would i go about doing this if it is possible?

Yes, it is possible.  There is a profiling option in IPS policies that is exactly for this.

Global Policy Options > Profile Lists > Profile Specific Processes.  Add the processes/executables you want to profile here.

Then, you will want to enable, just underneath that, at least the process assignment messages.  You can also log the command line arguments and create and destroy messages.

Note that when you add a process/executable to this list, that process will automatically be given FULL privileges to the system (it is necessary to allow access to things to actually profile the process).

This will create profile events locally on the agent, but will not send the events to the manager, but you can view them on the agent's Event Viewer.  If you want the events to get to the manager, you will have to edit the Prevention Config to tell the agent to send profile events to the manager.

To do this, go to Configs > Prevention > Symantec and make a copy of the Default Prevention Parameters.  Rename the copy of the config to something like "Send Profile Events"

Then, edit the new config, and go to the Log Rules tab.  Add a rule "Event Type" "In" and add all the profile events that are listed in the drop down menu.  Make sure that the radio button at the top says "Transmit in real time" and hit OK.  Then, to be sure no other rules get in the way, move this new rule to the top of the list.  Then, apply the config to the agent machine.

The profile events are located in a different table in the database, so you will not see them until you go to the Monitors tab and select the "Profile" section on the left.

That should do it.