EDR Rules
|
EDR rules, exclusions, and blocked hashes can now be managed directly from ESET PROTECT. These features will be released gradually throughout October 2026. Feature availability depends on your environment. |
Rules are the behavior and reputation-based descriptions that ESET PROTECT can identify from received events and metadata.
A rule is defined using XML-based language. Rules are matched on the server asynchronously, so there is some time interval when recent events are sent from client to server and then processed by rules. A matched rule can only notify security engineers by raising an indicator. A security engineer can perform a manual remediation action based on the investigation's results.
Filters and layout customization
You can customize the current Web Console screen view:
•Manage the side panel and main table.
•Add filters and filter presets. You can use tags for filtering the displayed items.
The window consists of the following parts:
•Name—The rule´s name.
•Severity—The rule´s severity: 
High, 
Medium, 
Low
•State—The rule´s state: Enable or Disabled.
•Author—The user´s name who was logged in at the time of the rule creation.
•Targets—The computer or group of computer where the rule is applied.
•Creation time—The time the rule was created.
•Last changed—The date the rule was changed.
•Last changed by—The author the rule was last changed by.
•Access group—The group with access to the rule.
•Response action—Automatic action taken when the rule is triggered.
Select a rule and click the Actions button, or click a rule to:
•
View details 
:
• Open—Open Indicators in Advanced Search or Exclusions
•
Enable—Enable the rule.
•
Disable—Disable the rule.
•Response actions—Select the rule response actions and process (Current process/Parent process) where to apply it:
Executable |
|
|---|---|
Block executable |
Prevent the executable from running by blocking it based on its SHA-1/SHA-256 hash. The blocked executable will appear in the Blocked executables section. |
Block and quarantine executable |
Prevent the executable from running by blocking it based on its SHA-1/SHA-256 hash, and permanently remove it from the computer by moving to the quarantine. The blocked executable will appear in the Blocked executables section. |
Block suspicious libraries |
Prevent suspicious libraries from being used by any process by blocking their SHA-1/SHA-256 hash. Blocked libraries will appear in the Blocked executables section. |
Process |
|
|---|---|
Kill process |
Kill the running process that triggered the rule. |
Computer |
|
|---|---|
Isolate computer from network |
Block all network communication on the computer, except for ESET applications. |
Shut down computer |
Shut down the computer where the rule was triggered. |
Log out user |
Log out the currently logged-in user on the affected computer. |
•
Edit—Edit the rule name, description or definition.
•
Manage targets—Add or remove targets for the rule.
•
Create exclusion—Create a new exclusion for the selected rule.
•
Apply rule preset—Restore ESET rules to a preset based on visibility and alert volume: Maximum visibility, Balanced coverage, Minimum noise. Click Review > Apply.
•
Access Group > Move—Move the object to another Static Group where it is available to users with sufficient rights for the target group. Changing the Access Group is useful when solving access issues with other users. Access Group sets the object's Static Group and access to the object based on the user's access rights.
•
Duplicate—Create a copy of the selected rule.
•
Export > Selected rules or All rules—Start the rule´s export process to an XML file.
•
Import—Open the window for importing the XML rule file.
•
Delete—Delete the rule.
Create a new rule
1.Click the New rule button.
2.In the Definition section, type or modify the criteria by the rule syntax.
3.In the Targets section, select the computers and groups to which you want to apply the rule.
4.Click Finish.