andrewek

EAM and software updates on the computer

Recommended Posts

Hello!

Earlier, when I was working for the EIS, he reported on the launch of any modified (updated) program.

For example, after updating any browser-EIS reported on the first start of the updated program- "the program was changed"!

I guess it was right!

Now EAM does not say anything after updating the programs on the PC.:huh:

So it should be? Is it done specifically to reduce the number of messages \ warnings?

Share this post


Link to post
Share on other sites

EAM has the same Behavior Blocker technology that EIS had, and should work the same way.

Note that each Application Rule does have an option not to alert when the file changes, so I recommend checking the Application Rules for programs that have recently changed which you expect to see such notifications for.

Also, keep in mind that EAM doesn't automatically create a ton of Application Rules for programs like EIS did. EAM doesn't have a firewall, and only needs Application Rules if you select to handle a program (allow or block) differently than it would have automatically handled it. In most cases there will be no Application Rules for programs when using EAM.

Share this post


Link to post
Share on other sites

Hello!

Thanks.I understood correctly - is it normal that the EAM does not report (alert) a change in the program after its update?

Specifically, worked Fx 56.02. Updated to Quantum (57.02). Should the EAM at the first start of a new, updated browser inform (alert) that the program has been changed? Now there are no such alerts ...

p.s. of course, I know that EAM differs from EIS in the absence of a firewall. The rest is the same!-_-

Share this post


Link to post
Share on other sites
On 12/8/2017 at 11:23 PM, andrey said:

... is it normal that the EAM does not report (alert) a change in the program after its update?

It is normal under these conditions:

  1. No Application Rule exists for the program.
  2. The option "Don't alert when this file changes" is turned on in an Application Rule.

 

On 12/8/2017 at 11:23 PM, andrey said:

Specifically, worked Fx 56.02. Updated to Quantum (57.02). Should the EAM at the first start of a new, updated browser inform (alert) that the program has been changed?

No, there shouldn't be any reason for a rule to exist for Firefox (it should always be automatically allowed as long as it is digitally signed by Mozilla) unless you manually created a rule for it, and thus you would never be alerted when Firefox changes.

 

On 12/8/2017 at 11:23 PM, andrey said:

p.s. of course, I know that EAM differs from EIS in the absence of a firewall. The rest is the same!-_-

The firewall may have been the main difference, however the presence of the firewall necessitated differences in when and why Application Rules were created for applications. The firewall created Application Rules for programs to define firewall rules for them the first time they did something that necessitated creating firewall rules. The Behavior Blocker doesn't work that way, and instead it automatically determines whether or not to allow things based on digital signatures and reputation every time they are executed and a behavior it monitors for is performed, and Application Rules are only necessary when you want to change how the Behavior Blocker handles a program (allowing it when it would be blocked by default, or blocking it when it would be allowed by default).

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.