Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 995308" data-attributes="member: 32260">I think that the info from the Microsoft documentation is related to the EDR console. In the EDR console, some ASR rules can produce additional alerts when Cloud Protection Level is High (or higher). But, for most ASR rules there will not be any additional alert even if the Cloud Protection Level is High. Still, the ASR rules will block the content independently of the fact that the EDR console alert was triggered or not. The normal alert on the client machines will be always visible.You can easily check it. Download the 7-ZIP installer:[URL unfurl=&quot;true&quot;]https://www.7-zip.org/a/7z2200-x64.exe[/URL]Copy it to the flash drive and run. It will be blocked by the ASR rule for USB even when the Cloud Protection Level is set to Default.Another simple test can be done for the Adobe ASR rule.Run Adobe Reader and press CTRL-O to open the Adobe file explorer window. Change the default file filtering from &quot;PDF files&quot; to &quot;All files (*.*)&quot;. Navigate to any EXE file on your hard disk and use the &quot;Run as administrator&quot; from right-click context menu. Normally this could run the EXE file as a child process of Adobe Reader. But, it will be blocked by the ASR rule.Edit.Works also for ASR script rule.</blockquote>

[QUOTE="Andy Ful, post: 995308, member: 32260"] I think that the info from the Microsoft documentation is related to the EDR console. In the EDR console, some ASR rules can produce additional alerts when Cloud Protection Level is High (or higher). But, for most ASR rules there will not be any additional alert even if the Cloud Protection Level is High. Still, the ASR rules will block the content independently of the fact that the EDR console alert was triggered or not. The normal alert on the client machines will be always visible. You can easily check it. Download the 7-ZIP installer: [URL unfurl="true"]https://www.7-zip.org/a/7z2200-x64.exe[/URL] Copy it to the flash drive and run. It will be blocked by the ASR rule for USB even when the Cloud Protection Level is set to Default. Another simple test can be done for the Adobe ASR rule. Run Adobe Reader and press CTRL-O to open the Adobe file explorer window. Change the default file filtering from "PDF files" to "All files (*.*)". Navigate to any EXE file on your hard disk and use the "Run as administrator" from right-click context menu. Normally this could run the EXE file as a child process of Adobe Reader. But, it will be blocked by the ASR rule. Edit. Works also for ASR script rule. [/QUOTE]

Verification