Behaviour Blocker

[Batman 3]

Dear Support,

What do you think about adding this option to the Behaviour Blocker?

Auto resolve, notifications for threats only for USER DECISION. (Not will be quarantined in 10s)
I think the option helps to reduce false and improve user experience.

[JeremyNicoll 78]

I don't quite understand.  "Auto resolve" means the BB /decides what to do/... so there's no scope for the user or anyone else to make a decision - it's already been made.

If you want to have the opportunity to make your own decision, you need to set "Alert".

[Batman 3]

With "Alert", EAM does not check suspicious program via Anti-Malware Network.

[SeriousHoax 2]

1 hour ago, Batman said:

With "Alert", EAM does not check suspicious program via Anti-Malware Network.

It does. When something is detected by signatures you'll see an alert. Other things that looks suspicious to behavior blocker, it'll check for reputation on Emsi cloud and if its marked as safe in the cloud then the action will be allowed automatically. 

[JeremyNicoll 78]

3 hours ago, Batman said:

With "Alert", EAM does not check suspicious program via Anti-Malware Network.

Perhaps you don't have Settings -> Advanced -> "Look up reputation of programs", turned on?

[GT500 861]

On 6/7/2020 at 5:55 AM, SeriousHoax said:

It does. When something is detected by signatures you'll see an alert. Other things that looks suspicious to behavior blocker, it'll check for reputation on Emsi cloud and if its marked as safe in the cloud then the action will be allowed automatically. 

That's correct. When set to "Alert" the BB will only display alerts for unknown applications. Anything known to be safe will still be allowed automatically. This behavior can be tweaked in the Advanced Settings using enabling/disabling the options Automatically allow programs with good reputation and Automatically quarantine programs with good reputation.