Cato Networks Custom Application Control: Configuration and Policy

Why Custom Application Control is a Critical Gap in Most Deployments?

Every enterprise network carries a category of traffic that falls outside the scope of standard application libraries — proprietary business systems, internally developed portals, legacy industry-specific tools, custom APIs, and vertical applications built for specific operational requirements. These applications do not appear in predefined catalogs. They do not have pre-built policy templates. And without explicit definition in the security platform, they are effectively invisible to policy enforcement.

The consequences of that invisibility are significant and underappreciated. Bandwidth consumed by an unrecognized ERP system cannot be prioritized, meaning it competes equally with video streaming and social media traffic during peak hours. Data moving through an unrecognized internal HR portal cannot be subject to DLP inspection, meaning sensitive employee records can transit the network without any controls. 

Sessions connecting to a custom manufacturing application cannot be inspected by IPS rules, leaving them exposed to exploitation without the protection applied to every other recognized application.

For organizations operating in the GCC region and across Africa — where proprietary enterprise systems, localized business applications, and industry-specific tools are particularly prevalent — this gap between what security platforms recognize by default and what organizations actually run is a practical security and operational challenge that demands a direct solution.

Cato SASE addresses this through custom application control: the ability to define any application not in the default catalog, apply the full Cato security and policy stack to it, and monitor its usage with the same depth available for predefined applications.

What is Cato Custom Application Control?

Cato's custom application control capability allows IT and security administrators to define applications that are not present in Cato's predefined application library, and then treat those applications as first-class citizens in the policy framework — subject to the same access controls, QoS prioritization, threat prevention inspection, DLP enforcement, and reporting capabilities available for any built-in application.

Once a custom application is defined, it integrates directly into the Cato Management Application's policy engine. It appears in the application catalog alongside predefined applications, can be referenced in firewall rules, QoS policies, and security profiles, and generates analytics data that appears in the same reporting interfaces used for all other application traffic.

The practical effect is that the boundary between "recognized" and "unrecognized" traffic disappears for the applications your organization defines. An internal ERP system running on a proprietary protocol becomes as visible and policy-manageable as Microsoft 365 or Salesforce. A custom API built by your development team becomes subject to DLP inspection and IPS threat detection. A legacy manufacturing application becomes a named entity in your security policy rather than an anonymous traffic flow.

This matters not just for security but for operational clarity. When every significant application your organization runs is named and defined in the policy platform, your security posture becomes auditable, your QoS configuration becomes purposeful, and your incident investigations become faster and more accurate.

Consult with us in just one tap

Key Takeaways

• What custom application control is and why it’s important
• Steps to create and define custom applications in Cato
• How to apply policies such as allow, block, prioritize, or restrict
• Monitoring and reporting on custom app traffic
• Practical use cases like controlling internal ERP or HR systems

Why Custom Application Control Matters?

While Cato provides a comprehensive library of applications (cloud, SaaS, collaboration, productivity), enterprises often have unique needs:

• Proprietary ERP systems running internally
• Custom APIs or portals developed in-house
• Legacy applications tied to manufacturing or construction systems
• Vertical-specific apps (finance, healthcare, engineering)

Without the ability to define these apps, visibility is lost, and policies cannot be enforced. Custom application control solves this gap.

Also Read: How the Cato Client Becomes the Identity Anchor for Zero Trust Access

Creating a Custom Application in Cato

Custom applications can be defined based on multiple identifiers, including:

• IP ranges or subnets
• Fully Qualified Domain Names (FQDNs)
• Protocols and ports
• TLS Server Name Indication (SNI)

Steps to configure:

1. Navigate to Security > Applications > Custom Applications.
2. Click Add New Application.
3. Provide a descriptive name (e.g., Internal ERP System).
4. Define the identification parameters (FQDN, IP, or port/protocol).
5. Save the application and verify it appears in the catalog.

Note: Custom applications are descendants of matching predefined applications. The first matching firewall or network rule is applied to the custom or predefined application. If you want to apply the rule action for a specific application, make sure that this rule is placed above any other rule that contains matching predefined applications. 

Applying Policies to Custom Applications

Once created, custom applications can be managed like any other app in Cato’s platform:

• Access Control – Allow, block, or restrict by user/group/site.
• Quality of Service (QoS) Prioritization – Assign high/medium/low priority to ensure business-critical apps (like ERP) are not impacted by bandwidth-heavy apps (like streaming).
• Threat Prevention Integration – Intrusion Prevention System (IPS), Anti-Malware, and DNS Security rules also apply to custom applications.
• Data Loss Prevention (DLP) Enforcement – DLP policies can monitor and control sensitive data transfer in both standard and custom applications.

Note: Although Cato Networks continuously updates its predefined application and service list, in some cases, you may not find a commonly-used application/service for which you are searching. If this occurs, please open a support ticket so that Cato adds the application/service to the predefined list. While you are waiting for the predefined application, you can create the specific application/service as a custom application as a workaround until it is available in the Cato Management Application. 

Also Read: Platforms, Countries, and Origin of Connection: Advanced Device Criteria in Cato Firewall

Monitoring and Reporting on Custom Apps

Administrators can track how custom applications are used via:

• Events > Application Events – See sessions, blocked attempts, and user activity.
• Analytics > Application Analytics – Monitor bandwidth consumption and user trends.
• QoS Reports – Validate if prioritization rules are working correctly.

Note: The App Analytics page includes data for blocked apps. This is because the Point of Presence (PoP) allows the client device trying to access the app to send multiple packets to the PoP, so it can identify the app and apply the block rule. This request and response traffic between the client device and PoP is included in App Analytics data. 

Real-World Use Case: Controlling an Internal ERP System

A construction company in the GCC region defined their custom ERP as a recognized app in Cato. With policies:

• ERP traffic was prioritized to guarantee stable performance.
• Access was restricted only to finance and project management teams.
• All ERP traffic was inspected under IPS and Anti-Malware for advanced threat prevention.

This provided full visibility, ensured compliance, and protected critical systems without deploying extra appliances.

Tips for Effective Custom Application Control

• Use FQDN over IPs when possible for better flexibility.
• Group related applications (ERP, HR, CRM) into application categories.
• Combine with user/group-based access policies for tighter control.
• Regularly review unused or outdated custom apps to avoid clutter.

Conclusion

Custom application control closes one of the most significant practical gaps between what enterprise security platforms recognize by default and what enterprise networks actually carry. For organizations running proprietary ERP systems, internally developed portals, legacy industry tools, or vertical-specific applications, the absence of custom application control means those applications operate outside the security policy framework — invisible to access controls, unprotected by threat prevention, unmonitored by DLP, and unmanaged by QoS.

Cato's custom application control capability brings those applications fully into the security framework without additional appliances, complex network changes, or application modifications. Once defined, a custom application receives the same depth of policy management, threat inspection, DLP coverage, and usage visibility as any predefined application in the Cato catalog.

For GCC and Africa enterprises where proprietary and industry-specific applications are particularly prevalent, this capability is not a niche feature — it is a foundational requirement for achieving the comprehensive visibility and consistent security posture that modern network environments demand.

Book a free consultation with our experts and explore how to configure, monitor, and secure your internal apps with Cato. 

Book Now

FAQs on Custom Application Control in Cato SASE 

What types of identifiers can I use to define a custom application?

You can define by FQDN, IP ranges, protocols, or port numbers. TLS SNI is also supported for encrypted traffic.

Can custom applications be used in QoS rules?

Yes. Once created, they can be prioritized or deprioritized like built-in apps.
 

How does custom application control work with threat prevention policies?

All defined apps are subject to IPS, DNS, and Anti-Malware rules. For example, if a custom app connects to a malicious domain, DNS protection will still block it.
 

What’s the difference between custom applications and categories?

Applications are individual definitions, while categories allow grouping multiple apps together for policy enforcement.
 

Can DLP policies apply to custom applications?

Yes. Cato’s DLP engine can monitor and control sensitive data transfer in both standard and custom applications.