Recommended way to deal with user actions

[karsayor 8]

Hello

Currently evaluating ESET Inspect, I'm wondering about the default rules created by ESET but that have no user actions. If I understand correctly, once exclusions have been made by learning mode, we should be able to set protective actions to the rules, especially the threats rules. But afaik, there is

1. No way to mass enable user actions on rules, so you have to edit them all 1 by 1 😐
2. No recommended user actions on rules. ESET should recommend default user actions for the rules they make because they know what is the best protective action for a rule

What is the right way to deal with these ? We are a Service Provider and we cannot afford to go on each console of each customer to edit manually each rule..

[thae 11]

1. Correct
2. There are some Threat rules where a user action, like blocking, is set. E. g. B1005, it kills the process on this computer.

[karsayor 8]

Thanks for the feedback. It still feels like we are left alone with those users actions, they should do the job to the end and recommend us what user actions to do for each rules. They know best what impact / severity each threat has.

[j91321 6]

On 7/4/2024 at 9:24 AM, karsayor said:

once exclusions have been made by learning mode, we should be able to set protective actions to the rules

Well, while using learning mode will definitely help you to create the most common exclusions for your environment, enabling some form of action on all rules after that would be an oversimplification. The general rule of thumb is that if  maliciousTarget name="module" you use Block Executable and if it is "current" or "parent" you use KillProcess.

Then you can check tags like "Aggressive Kill" to filter for rules, where you can apply KillProcess action (although I don't recommend using all these rules in production).

If we know the rule doesn't cause problems for most of the customers, it'll have automatic action assigned by default. We try to review these regularly.

It really doesn't work the way you are describing @karsayor. When we write rules and add actions to them they must work for everybody and this limits us. You know your environment best and are the person who can make an informed decision what is and isn't normal for your environment. I agree that, maybe we should re-think some user-experience aspects of this.

On 7/4/2024 at 9:24 AM, karsayor said:

No way to mass enable user actions on rules, so you have to edit them all 1 by 1 😐

Yes, unfortunately this is true. We register this issue as a a pain point for the users. 

Edited July 21 by j91321