AutoElevate 'Blocker': Reverse Rule Precedence | AutoElevate

AutoElevate 'Blocker': Reverse Rule Precedence

Alexander Houston

Currently, Blocker rule precedence follows that the 'lowest level' in the hierarchy (Computer) takes precedence OVER higher levels. This also means that 'All Companies' rules are superseded by more specific 'Whole Company' rules.

It would be very helpful to REVERSE this rule precedence; as the way 'recommended blocks' work and how organizations scale, it quickly becomes unfeasible to maintain a list of identical exceptions (e.g., for your security stack or RMM tools) across many different companies, per-company, while having the recommended blocks at the 'All Companies' level. (The recommended blocks are more general and almost never change; the rule exceptions change frequently. One level lower in the precedence means we have to multiply the total number by the number of tenants, at the minimum)

A week ago

Daniel Rivera

Thanks for clarifying, Alexander. A setting just for your account makes sense, and we've added that detail to the request. One thing that would need working through: with top-down order, an All Companies rule would always win, so any company- or computer-level rule you use today as an exception for a single company would stop taking effect. We'll look at this alongside the work on managing exceptions across companies, and we'll update this post as it moves.

Alexander Houston

I should clarify this feature request; I'd want the ability to reverse rule precedence for our specific tenant; maybe a switch under 'settings' or something similar. Of course other organizations order their rules differently or have different management requirements, so the bottom-up GPO-style precedence makes more sense for them. In a multi-tenant environment, top-down makes more sense.

Daniel Rivera

Thanks Alexander, the numbers make the problem clear. One thing that may help today: within the same level, the more specific rule is checked first. So an All Companies exception that adds criteria beyond the file name (for example, allowing powershell.exe only when your RMM agent launches it) takes priority over an All Companies recommended block for that file, and one list covers every company. If that doesn't match what you're seeing, please reach out to support@autoelevate.com with an example and they can take a look at your rules. Reversing the order for everyone would change how existing rules behave for a lot of partners, so that's unlikely to be the approach, but managing exceptions across companies is something we're looking at, and your example has been added to it. Votes here will help us prioritize it.

Alexander Houston

For us this means, ~170 rule exceptions instead becomes over 12,000 rule exceptions. (Multiply them by the number of tenants we have) It's much easier to instead manage a single list.