Reply to thread

Message

<blockquote data-quote="AtlBo" data-source="post: 700324" data-attributes="member: 32547">Brainstorming some this AM.&nbsp; [USER=68429]@NoVirusThanks[/USER] (Andreas), have you considered making this a companion of your updated NTV ERP?&nbsp; What I am considering is the possiblity of using the OSArmor component and its rules to wipe out the need for discovery of &quot;clean&quot; Windows system protected processes in ERP.&nbsp; This would mean that ERP users wouldn&#039;t need to simply allow all Windows processes.&nbsp; They could without the extra effort use a customized version of Windows processes that should be allowed by default.&nbsp; For sure some of them should be imo monitored by command-line usage, i.e. runonce.&nbsp; There is more, too, as all the rules of OSArmor could be incorporated for monitoring types of files and the others too.I am beginning to develop a desire to come up with a list of common Windows based command lines/wildcard command lines for ERP, so that settings and rules can be transferred onto a new PC easily with NVT ERP running.&nbsp; After going over the list of Windows allowed that were added in the first hour or so I used NVT ERP on this PC, I noticed some of these processes that I would prefer to allow via the command line option, so I removed them from the allowed list.&nbsp; These made it into the list while I was running ERP with &quot;Allow Microsoft Windows system protected processes&quot; checked (I believe that is the default on installation?).IDK and o/c you know these products far better than I.&nbsp; However, I could see both these apps in one without any overlap, using a single GUI.&nbsp; I am envisioning side by side dialogs, one for applications (ERP) and one for the OS (OSArmor).Maybe you could even come up with a nice way in NVT OSArmor of monitoring Runonce and other startups without the risk that the Windows process might be unknowingly auto allowed by a user as with NVT ERP.&nbsp; This is sort of a well trained HIPS module that is smart enough imo to be thought of as behavior blocker.&nbsp; Another good thing to monitor would be running tasks.&nbsp; If a task wants to start, using OSArmor alert, user can block the task once or for each attempt (maybe even disable the task LOL, although I think I am seeing possible UAC development challenges for standard user account users <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite119" alt=":rolleyes:" title="Roll eyes&nbsp; &nbsp; :rolleyes:" loading="lazy" data-shortname=":rolleyes:" />).&nbsp; There is always monitoring of changes to drivers too and I suppose others.</blockquote>

[QUOTE="AtlBo, post: 700324, member: 32547"] Brainstorming some this AM. [USER=68429]@NoVirusThanks[/USER] (Andreas), have you considered making this a companion of your updated NTV ERP? What I am considering is the possiblity of using the OSArmor component and its rules to wipe out the need for discovery of "clean" Windows system protected processes in ERP. This would mean that ERP users wouldn't need to simply allow all Windows processes. They could without the extra effort use a customized version of Windows processes that should be allowed by default. For sure some of them should be imo monitored by command-line usage, i.e. runonce. There is more, too, as all the rules of OSArmor could be incorporated for monitoring types of files and the others too. I am beginning to develop a desire to come up with a list of common Windows based command lines/wildcard command lines for ERP, so that settings and rules can be transferred onto a new PC easily with NVT ERP running. After going over the list of Windows allowed that were added in the first hour or so I used NVT ERP on this PC, I noticed some of these processes that I would prefer to allow via the command line option, so I removed them from the allowed list. These made it into the list while I was running ERP with "Allow Microsoft Windows system protected processes" checked (I believe that is the default on installation?). IDK and o/c you know these products far better than I. However, I could see both these apps in one without any overlap, using a single GUI. I am envisioning side by side dialogs, one for applications (ERP) and one for the OS (OSArmor). Maybe you could even come up with a nice way in NVT OSArmor of monitoring Runonce and other startups without the risk that the Windows process might be unknowingly auto allowed by a user as with NVT ERP. This is sort of a well trained HIPS module that is smart enough imo to be thought of as behavior blocker. Another good thing to monitor would be running tasks. If a task wants to start, using OSArmor alert, user can block the task once or for each attempt (maybe even disable the task LOL, although I think I am seeing possible UAC development challenges for standard user account users :rolleyes:). There is always monitoring of changes to drivers too and I suppose others. [/QUOTE]

Verification