This article describes the main settings that control how Resolve is allowed to act in your environment, and when human admin approval is required.
Admin approval for actions
By default, Resolve requires an admin to click Approve on the investigation before it runs a diagnostic or mitigation action.
You can change the approval requirements in Settings > Actions & Approvals > Approvals. Four independent toggles control which actions run automatically and which wait for a person, based on two factors combined:
- Action type: diagnostic (gathering evidence) vs. mitigation (making a change)
- Execution context: user context (the action runs under the logged-in
user's own session and permissions) vs. system context (the action runs
under the system account, with elevated privileges)
Enabling a toggle requires that combination require approval. Disabling the toggle requires an admin to approve that type of action.
Investigation escalation controls
This section describes how you can control which investigation levels are allowed to run, and how investigations escalate to a higher level. If you aren't familiar with the investigation levels and how they escalate, read Investigation Levels..
Patterns-only mode
You can enable Patterns-only mode to restrict Resolve to only run an investigation if the issue matches one of your approved Patterns (level 1). If no matching pattern is found, Resolve stops the investigation and end users are told to contact IT.
Enable this setting under Settings > Investigations > Autonomy > Actions & Approvals > Execution policy. When you enable it, you can choose to exclude certain devices from the restriction by specifying device IDs, groups, or tags.
If you use Patterns-only mode, it's important that you have a broad library of Patterns to draw from. You can do this by:
- Excluding certain devices from the Patterns-only restriction. Resolve will learn new Patterns on those devices. After a Pattern is learned and approved, it can be put to use in the rest of your organization's devices.
- Temporarily running Resolve with Patterns-only mode disabled until a significant number of patterns are learned. To reduce risk during this time, you can require all investigation actions to be approved by an admin. You can then enable Patterns-only mode.
Manual override for Patterns-only mode
If the manual override option is enabled, a ControlUp user can manually click Escalate to escalate a specific investigation to the open-ended model (level 3).
Admin approval for investigation escalations
By default, Resolve requires an admin to approve the escalation before an investigation can move to the open-ended model (level 3).
If you want investigations to auto-escalate to level 3, enable Auto-escalate under Settings > Investigations > Autonomy > Auto Escalation.
Investigations never require approval to escalate from level 1 to level 2, although you can lock devices to level 1 using the Patterns-only mode setting.
Guardrails
A guardrail is a policy that defines what Resolve is never allowed to do during an investigation. To add guardrails, go to Settings > Guardrails. For example, you might want to prevent Resolve from changing certain registry paths, or from making changes to your security software.
You can select from predefined guardrails, or you can create a custom guardrail by explaining the policy in plain language. You can apply a guardrail to only specific devices by targeting device IDs, tags, or groups.