Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 986242" data-attributes="member: 32260">I am not sure what you mean by my proposition. My proposition is to use only two levels: &quot;pre-execution stage&quot; (L1+L2) and &quot;on(post)-execution stage&quot; (L3). This will be more understandable for readers. From a few threads about AVLab testing, it follows that readers can have serious problems with understanding the meaning of Levels 1,2, and 3. These levels are strictly connected with the testing methodology without a clear connection with the AV proactive features. One could recover some connections by analyzing the logs, detection names, event IDs, etc. but this would be time-consuming and would probably require some help from the AV vendors. The only AV testing lab that tries to do it (in a limited way) is MRG Effitas:[ATTACH=full]266211[/ATTACH]My proposition is only a loose suggestion. There is nothing wrong with Levels 1,2, and 3, although the current description of these levels can be misguiding for some readers.</blockquote>

[QUOTE="Andy Ful, post: 986242, member: 32260"] I am not sure what you mean by my proposition. My proposition is to use only two levels: "pre-execution stage" (L1+L2) and "on(post)-execution stage" (L3). This will be more understandable for readers. From a few threads about AVLab testing, it follows that readers can have serious problems with understanding the meaning of Levels 1,2, and 3. These levels are strictly connected with the testing methodology without a clear connection with the AV proactive features. One could recover some connections by analyzing the logs, detection names, event IDs, etc. but this would be time-consuming and would probably require some help from the AV vendors. The only AV testing lab that tries to do it (in a limited way) is MRG Effitas: [ATTACH type="full" alt="1651163427580.png"]266211[/ATTACH] My proposition is only a loose suggestion. There is nothing wrong with Levels 1,2, and 3, although the current description of these levels can be misguiding for some readers. [/QUOTE]

Verification