Notification when user disables Endpoint Security modules

[Sander de Cocq 0]

 

ESET Security Management Center (Server), Version 7.0 (7.0.577.0)
ESET Security Management Center (Web Console), Version 7.0 (7.0.429.0)
Microsoft Windows Server 2012 R2 Standard (64-bit), Version 6.3.9600 

Hello, our company policy requires that an email notification is sent when an end-user disables or pauses real time file protection, HIPS, Memory scanner, exploit blocker or ransomware shield. I've looked at the included alerts, could not find a match, and disabling the scanner is not shown as a Threat. Is it possible to create such an alert?  (ESET Endpoint Security 7.1.2045.5 and newer)

[Marcos 4,709]

There is a default dynamic group Problematic computers which is defined as:

That said, any machines that have a protection feature disabled will fall into this dynamic group.

Then in Notifications enable this one which you can customize, if needed:

[Sander de Cocq 0]

Thank you for your prompt reply, this looks like a good solution. I will try it out.