App Review COMODO Internet Security Pro 2027

[rashmi]

Yes, however, I do not recall if we noticed at that time that other rules can remove the file age dependence from some delivery scenarios, such as files downloaded from the Internet, Intranet, etc. In the end only some scenarios can depend on the file age.

What do you mean? I'm unsure, but I think the "File Age" rule should work in all scenarios; you can either add the file age criteria to the rules in the Internet Security config, or you can keep the "All Applications—Unrecognized—3 days" rule and disable the below rules.

 

[Andy Ful]

What do you mean? I'm unsure, but I think the "File Age" rule should work in all scenarios;

This is a general rule for all files. The next rules modify it because they are more specific (valid for some groups of files).
As you can see in the test for BAT files from my previous post, the BAT file on the flash drive was still contained even 3 days after creation.

 

[rashmi]

This is a general rule for all files. The next rules modify it because they are more specific (valid for some groups of files).
As you can see in the test for BAT files from my previous post, the BAT file on the flash drive was still contained even 3 days after creation.

I meant Comodo should allow the file in all scenarios if you add the file age criteria to the containment rule/s. For example, Comodo should allow the BAT file on the flash drive after 3 days. Does editing the rule/s work, i.e., allow the BAT file on the flash drive?

 

[Andy Ful]

I meant Comodo should allow the file in all scenarios if you add the file age criteria to the containment rule/s.

This works if there are no other more specific rules

For example, Comodo should allow the BAT file on the flash drive after 3 days. Does editing the rule/s work, i.e., allow the BAT file on the flash drive?

You can remove the "Removable Media" group from the rule below:

As you can see, the file age for this rule is unlimited.
The File Age rule in the CIS default configuration works for all supported file types, not only for BAT files. In my test, I used BAT files because they can be easily created.

 

[rashmi]

@Andy Ful, I tested the BAT file scenarios (#Post97) using the default Internet Security config and kept the "All Applications—Unrecognized—1 hour(s)" rule while disabling the rules listed below.
With the default Internet Security config, after 1 hour, the test1 file runs outside the container, but both the test2 files run inside, as per KillSwitch.
With the edited config, after 1 hour, all files run outside the container, as per KillSwitch.