Hi, I thought I had a buggy internet connection, because the PC sometimes frooze for an instance (1 sec at the most). Next I discovered Mamuto applies a community check after finding an intrusion. I have now an automatic rule "when more than 90% of the community members allowed an intrusion, set it to allow on only this behaviour". Seems guys from Mamuto have implemented the ideas of Windows Defender and ThreatFire very fast. Credits are to PrevX for being the first to actively use community protection. Mamuto is a good runner up.