Process Blocking

Configure which applications are blocked by the Process Guard.

Overview

The Process Guard monitors running processes and terminates unauthorized applications. Processes are matched by name.

Default Blocked Processes

BlueSentinel blocks 25+ applications by default:

Cloud Sync Clients:

  • Dropbox, Google Drive (Backup and Sync), OneDrive, iCloud Drive, Box Sync

File Transfer Tools:

  • FileZilla, WinSCP, Cyberduck, Transmit

Remote Access:

  • TeamViewer, AnyDesk, RustDesk, Chrome Remote Desktop

Messaging:

  • Telegram Desktop, Signal Desktop, Discord

Torrent Clients:

  • qBittorrent, uTorrent, Transmission, Deluge

VPN Clients:

  • OpenVPN, WireGuard, NordVPN, ExpressVPN (unauthorized VPNs)

Adding Custom Processes

  1. Navigate to Policies → select your policy
  2. Edit the Process Guard section
  3. Add process names to the Blocked Processes list
  4. Choose mode: block (kill on detection) or alert (log only)

Block vs Alert Mode

  • Block mode — The process is terminated immediately on detection. A CRITICAL alert is generated.
  • Alert mode — The process is allowed to run, but a MEDIUM alert is logged for review.

Process Detection

The guard uses psutil to scan running processes at a configurable interval. Process names are matched case-insensitively.