Allowlist RevoAgent

Allowlisting tools such as ThreatLocker block software that hasn't been approved, including RevoAgent and each new version it updates itself to. Allow the agent by its file hash.

One hash per release and platform

Every installer of a release contains the same agent binary. The EXE download only changes its file name, and the MSI wraps the same binary. So one SHA-256 hash per release and platform covers every installation, for every customer.

The hashes are listed under ThreatLocker / allowlisting in Settings → Agents, and on each customer's Customer settings → Install agent page.

Set it up in ThreatLocker

1. In ThreatLocker, create a custom application named "RevoAgent".
2. Add a hash rule for each published agent hash you use (Windows x64, and Windows on Arm if you have it).
3. Permit the application organization-wide or globally.
4. When a new agent release is published, add its hash before devices update, so the update isn't blocked.

Blocked updates

When ThreatLocker is connected, the allowlisting panel also lists agent updates waiting for approval in ThreatLocker: pending approval requests whose file hash matches a published RevoAgent release. Approve them in the ThreatLocker portal. Revo never approves requests itself.

If an agent stops checking in right after it was offered an update, Revo raises Agent stopped after an update (see Notifications). A blocked update is a common cause.

Why hashes and not a certificate

The Windows agent isn't Authenticode-signed yet, so a certificate rule isn't possible. Each release is signed with Revo's own release key, and the agent verifies that signature before it installs an update, but allowlisting tools can't check that signature. Use the hash rule.

Other allowlisting tools

The same hashes work for any tool that allows software by SHA-256. The hash list is also available from the API (GET /api/v1/agent-releases/hashes) for automation.