AppLocker Block Events

The AppLocker Block Events check counts on Windows devices (x64, ARM64) how often AppLocker blocked an execution within the chosen window. Optionally, it also counts audit-mode events, meaning executions that would have been blocked. It runs locally through the octoja agent, every 15 minutes by default.

Prerequisites

• You need the Monitoring Check Management permission.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → AppLocker Block Events.
3. Adjust the settings if needed.
4. Click Add Check.

To roll it out to many devices at once, use a config package.

Settings

• With the defaults (both thresholds 1), a single event already results in Critical; a warning never occurs. Set Error count higher than Warning count if you want a warning level.
• If Warning count is higher than Error count, the check swaps the two values.
• A threshold of 0 is always reached: the check then reports that result even without any events.
• If the lookback window is shorter than the check interval, events between two runs can go unnoticed.

Results

The check reads the EXE and DLL, MSI and Script, Packaged app-Execution and Packaged app-Deployment logs under Microsoft-Windows-AppLocker. It counts block events 8004, 8007, 8022 and 8025 and, with audit events included, also 8003, 8006, 8021 and 8024.

The check does not verify that AppLocker is configured. A missing log counts as 0 events, so the result is OK.

See also: Assign checks with config packages · Set up alerts for a check