Details
ESET business product in Limited Support status
This article applies to an ESET product version that is currently in Limited Support status and is scheduled to reach End of Life status soon.
For a complete list of supported products and support level definitions, review the ESET End of Life Policy for business products.
ESET’s Host-based Intrusion Prevention System (HIPS) is included in ESET Endpoint Security, ESET Endpoint Antivirus, ESET Mail Security for Microsoft Exchange, and ESET File Security for Microsoft Windows Server. HIPS monitors system activity and uses a set of pre-defined rules to recognize suspicious system behavior. When this type of activity is identified, the HIPS self-defense mechanism stops the offending program or process from carrying out potentially harmful activity. Changes to the Enable HIPS and Enable Self-defense settings take effect after the Windows operating system is restarted.
Solution
Endpoint users: Perform these steps on individual client workstations
Advanced users only!
By default, the Host-based Intrusion Prevention System (HIPS) is pre-configured to ensure maximum protection of your system. While the creation of a HIPS rule may be needed to resolve an issue in certain infrequent cases, the manipulation of HIPS rules requires advanced knowledge of applications and operating systems and is not recommended.
- Open ESET Security Management Center Web Console (ESMC Web Console) in your web browser and log in.
- Click Policies, click the gear icon next to the policy you want to modify, and then select Edit from the context menu.
Figure 1-1
Click the image to view larger in new window - Click Settings → Detection Engine → HIPS, and then click Edit next to Rules.
Figure 1-2
Click the image to view larger in new window - Click Add.
Figure 1-3
- Configure your rule. In the example, operations affecting registry entries are blocked, and the end-user will be notified when this action is performed by the HIPS module. When you are finished, click Next.
Figure 1-4
- In the Source applications window, select your desired option from the drop-down menu. In this example, the HIPS rule will block any application that attempts to modify registry values. Click Next.
Figure 1-5
- In the Registry operations window, specify which operations will trigger this rule. In this example, Delete from registry is selected. Click Next.
Figure 1-6
- In the Registry entries window, select your desired option from the drop-down menu. In this example, we are blocking the deletion of any registry entries. Click Finish.
Figure 1-7
- Click OK to save the rule.
Figure 1-8
- Select how HIPS rules defined by this policy will interact with previously defined HIPS rules on the assigned computers (read more about policy merging in the Online Help).
- Click Finish. Computers assigned to the policy you modified will receive this new HIPS rule the next time they check into ESET Security Management Center Server (ESMC Server).
Figure 1-9