Actions

Actions tag allows you to specify a set of actions that are executed when the rule is triggered.

Action names are:

•BlockModule—Blocks DLL that is being loaded in the LoadDll event.

•BlockParentProcessExecutable—Blocks a parent process hash (only if not trusted1 or ESET LiveGrid® info is missing).

•BlockProcessExecutable—Blocks a process hash (ban hash via the rule, only if not trusted1 or ESET LiveGrid® info is missing).

•BlockProcessSuspiciousModules—Blocks a module marked as suspicious by MarkModuleSuspicious action.

•CleanAndBlockModule—Blocks dropped module in the ModuleDrop event.

•CleanAndBlockParentProcessExecutable—Cleans and blocks a parent process hash (only if not trusted1 or ESET LiveGrid® info is missing).

•CleanAndBlockProcessExecutable—Cleans and blocks a process hash (only if not trusted1 or ESET LiveGrid® info is missing).

•CleanAndBlockProcessSuspiciousModules—Cleans and blocks a module marked as suspicious by MarkModuleSuspicious action.

•DropEvent—Drops an event that triggered the rule.

•IncreaseParentRiskScore—Increases the risk score of the parent process by set value. When risk score threshold is reached KillParentProcess action is triggered.

•IncreaseRiskScore—Increases the risk score of the process by set value. When risk score threshold is reached KillProcess action is triggered.

•IsolateFromNetwork—Isolates the computer from the network.

•KillParentProcess—Kills parent of the running process that triggered the detection (only if not trusted1 or ESET LiveGrid® info is missing)

•KillProcess—Kills running process that triggered the detection (only if not trusted1 or ESET LiveGrid® info is missing)

•LogOutUser—Logs out the user from the operating system

•MarkAsCompromised—The process that triggered the rule will be marked as compromised. This status is visible in the process details view in the Web Console.

•MarkModuleSuspicious—Marks a module as suspicious.

•Reboot—Reboots computer that triggered the detection.

•Shutdown—Shutdowns computer that triggered the detection.

•StoreEvent—Stores events that triggered the detection from this rule regardless of other settings. You can use it if the events are not stored by default.

•SubmitModuleToLiveGuard—Submits module to ESET LiveGuard.

•SubmitParentToLiveGuard—Submits parent of the executable that triggered the detection to ESET LiveGuard.

•SubmitToLiveGuard—Submits executable that triggered the detection to ESET LiveGuard.

•TriggerDetection—If you do not specify actions in the actions tag field, this action is executed by default and the detection triggers in ESET PROTECT. If other actions are specified, and you still want to trigger detection, you must add this action.

1 A trusted process is a process that has an ESET LiveGrid® reputation level equal to or higher than 8.

The table below shows rate limit for each action:

˄˅