Focus

Traps Endpoint Security Manager Administrator's Guide

Compare Policies

Table of Contents

Compare Policies

At regular intervals, Traps requests an updated security policy from the ESM Server and stores it in the system registry on Windows endpoints. When a user starts a process, Traps determines whether or not to protect the process based on the settings in the security policy.

In troubleshooting scenarios where Traps does not behave as expected, use the cytool policy compare command to view differences in policies that are applied to processes running on the endpoint. Using the command, you can compare a policy for a process to the default security policy or compare a policy for a process to a policy for another process. In both cases, you can specify either the name of the process or the process ID (PID). Specifying the process name simulates the application of the policy to the process. Specifying the PID queries the effective policy for the running process. Cytool displays the policy settings side-by-side and indicates any differences between policies in red.

To compare policies, you must enter the supervisor password when prompted.

Open a command prompt as an administrator and navigate to the Traps folder (see Access Cytool).
Compare the details of two policies:
- To compare the policy to the default policy, use the following command:
```
C:\Program Files\Palo Alto Networks\Traps> cytool policy compare <process> default
```
  where <process> is either the process name or process ID (PID).
  The following example displays output for comparing a policy that applies to notepad to the default policy. Differences between the two policies are shown in red.
```
C:\Program Files\Palo Alto Networks\Traps>cytool policy compare notepad default
Enter supervisor password:
Generic
Enable 0x00000001 0x00000001
SuspendOnce 0x00000001 0x00000001
AdvancedHooks 0x00000001 0x00000001
[...]
DllSec
Enable 0x00000001 0x00000000
Optimize 0x00000001 0x000000011
[...]
```
- To compare the policies for two processes, use the following command:
```
C:\Program Files\Palo Alto Networks\Traps> cytool policy compare <process1> <process2>
```
  where <process1> and <process2> are either the process name or process ID (PID). For example, to compare the policy applied to iexplorer to the policy applied to chrome, enter cytool policy compare iexplorer chrome. You can also compare the policies for two PIDs or compare the policy of a process to a policy of a PID.
  The following example displays output for comparing the policies applied to two PIDs, 1592 and 1000. Differences between the two policies are shown in red.
```
C:\Program Files\Palo Alto Networks\Traps> cytool policy compare 1592 1000
Enter supervisor password:
Generic
Enable 0x00000001 0x00000001
SuspendOnce 0x00000001 0x00000001
AdvancedHooks 0x00000001 0x00000001
[...]
DllSec
Enable 0x00000001 0x00000000
Optimize 0x00000001 0x000000011
[...]
```

View Details About an Active Policy

Manage Logging of Traps Components Using Cytool