Cisco Security Agent

[akundigraber]

Is it possible to check windows registry entries and deny or permit, for example, network access depending on the value? ( if any key in HKLM\SOFTWARE\CSCOpx\** have a value=1 than deny network access or so)

thanks

Armin

[gfullage]

Sorry for the delay in responding, this message would have been better in the Security forum.

It's not possible to deny/permit based on existing registry values specifically. The Registry Access Control (RAC) rules deny/permit apps from writing new registry entries of a certain value, not to check existing entries.

You could create a RAC that allows the writing of registry entries equal to 1 under HKLM\SOFTWARE\CSCOpx\**, but set the Action on the rule to "Add process to Application Class". Then create a Network Access Control rule under the same policy that denies all network access to this App Class.

This will stop network access to any app that writes a registry entry equal to 1, which is not really what you want I don't think, but that's about the closest you can get.