I am looking into whitelisting applications and the Snow handbook says installation or usage of an application which is not on the whitelist will result in an alert. Is that truly every application that is not on the whitelist? What about applications that are not whitelisted because only some users have access?
I understand that if a blacklisted application is installed or used that an alert is issued, which makes sense. But it doesn't make sense to issue an alert every time an application that is not on the whitelist is used.
Can someone please give me more information on this?