Question - File Changed - What is Recommended, Update or Remove Rule?

[hjlbx 2]

Hello,

 

I am just looking for guidelines...for a better understanding.

 

What is generally the best response to a "File has changed" alert  - Update Rule or Remove Rule and continue to monitor.

 

I have been assigning Custom Rules that stop alerts for specific actions/behaviors, but continue to monitor - as opposed to simply  assigning the "Allow" rule for everything.

 

How do the rules that users assign affect the Anti-Malware Network cloud?

 

Thanks,

 

hjlbx

[Fabian Wosar 390]

When a file changes, what is generally the best recommended action - Update Rule or Remove Rule and continue to monitor.

That depends. If you would remove the rule just to create the same custom rule again you may just as well skip the removal step and just update the rule outright. In general if you expect the file to change (because you just installed an update or because you saw the auto-update feature of that application running) it is safe to just update the rule.

 

How do the rules that users assign affect the Anti-Malware Network cloud?

Custom rules take precedence over cloud rules. If there is a rule for a specific behavior it will be used and the cloud won't be queried at all.

[hjlbx 2]

 

Custom rules take precedence over cloud rules. If there is a rule for a specific behavior it will be used and the cloud won't be queried at all.

 

Very good...

 

Thank you,

 

hjlbx

[The Banned 1]

Hi bro i dont know if that are your cuestion but its simple if you changue the file or you know are know file an ie update for example or windows update office update etc you can allow but if its suspicious update not on demand and not know dont allow, Its more simple say alow when i update steam i have to allow or update rule

[Fabian Wosar 390]

You are welcome, hjlbx.