About hips

[dorgane]

hi,

i have keep hips default configuration, just add "logs all blocked..."
it is normal, i have many operation blocked ?


hips.xml.txt


thank you,
and sorry for my bad english

[dorgane]

hum,
i have found the learning mode, i have switch...but there not notification when rules are creates (but thefirewall learning mode have notifications).


edit :

after this screen



learning mode make duplication for one rule?

thank you

[kryptoncs]

Put the HIPS config into Automatic mode. That will ensure more protection.

[dorgane]

automatic hips don't block rogue :
http://www.wilderssecurity.com/showthread.php?t=298981

[toxinon12345]

In Automatic mode, rules should be created in a blacklisting approach (blocking operations), cause all others operations are allowed
in policy-based mode, is the opposite: the rule set should be created using a whitelisting approach, cause all the others are forbidden

and interactive mode, you should create a rule set using automatic decisions, cause all other operations are asked

[trjam]

Eset would be wise to contract with Mike Nash on rule creating for its HIPS.

[dorgane]

yes, i suggest :

http://www.wilderssecurity.com/showthread.php?t=298956

Hips : Cloud Rule

If not green and low/new reputation, they ask for hips