Reply to thread

Message

<blockquote data-quote="shmu26" data-source="post: 777522" data-attributes="member: 37647">The vulnerable processes are in the Windows folder, and they are set to alert. That behavior is important for security. So you don&#039;t want to exclude the whole Windows folder.Exclude is stronger than Allow. It will override an Alert rule. Allow is weaker; it will not override an Alert rule.By default, you will not get alerts from any Windows processes in the Windows folder, except for the vulnerable processes that are set to Alert. So you already have the setting you want, by default.You can manually add (or subtract) any Trusted Vendor you want. If you have a suggestion for the dev, just PM him about it.I don&#039;t know how he decided which ones to be on the default list, I guess he based himself on both on the software that companies tend to use, and the software that us security geeks tend to use. That&#039;s what it looks like, at first glance. But it&#039;s customisable, so it doesn&#039;t really matter so much what&#039;s on the default list.One thing is for sure: if Andreas put a vendor on the list, it is a reliable vendor.But their sig could still be stolen or faked. So it&#039;s always better to have less &quot;Trusted&quot; vendors, as long as it doesn&#039;t cause you grief.</blockquote>

[QUOTE="shmu26, post: 777522, member: 37647"] The vulnerable processes are in the Windows folder, and they are set to alert. That behavior is important for security. So you don't want to exclude the whole Windows folder. Exclude is stronger than Allow. It will override an Alert rule. Allow is weaker; it will not override an Alert rule. By default, you will not get alerts from any Windows processes in the Windows folder, except for the vulnerable processes that are set to Alert. So you already have the setting you want, by default. You can manually add (or subtract) any Trusted Vendor you want. If you have a suggestion for the dev, just PM him about it. I don't know how he decided which ones to be on the default list, I guess he based himself on both on the software that companies tend to use, and the software that us security geeks tend to use. That's what it looks like, at first glance. But it's customisable, so it doesn't really matter so much what's on the default list. One thing is for sure: if Andreas put a vendor on the list, it is a reliable vendor. But their sig could still be stolen or faked. So it's always better to have less "Trusted" vendors, as long as it doesn't cause you grief. [/QUOTE]

Verification