Protect your system's access points based on configured rules. Access Protection compares a requested action against the list of configured rules and acts according to the rule.
Access Protection settings apply to Windows and Linux systems only.
Best practice:
For information about creating Access Protection rules to protect against ransomware, see
KB89335, and
KB89540.
Option definitions
| Section
|
Option
|
Definition
|
|
Access Protection
|
Enable Access Protection
|
Enables the Access Protection feature.
|
Advanced options
| Section
|
Option
|
Description
|
|
Exclusions
|
|
Allows access to the specified item for all rules.
- Add — Adds a item to the exclusion list.
Operating System
- Windows — Adds a Windows exclusion.
- Linux — Adds a Linux exclusion.
- Delete —
Deletes the selected item.
- Actions —
- Edit —
Changes the selected item.
- Duplicate —
Creates a copy of the selected item.
Access Protection exclusions don't apply to the Windows
Services subrule type.
|
|
|
Rules
|
|
Configures Access Protection rules.
You can enable, disable, and change
Trellix-defined rules, but you can't delete these rules.
- Add — Creates a custom rule and adds it to the list.
Operating System
- Windows — Adds a rule for Windows systems.
- Linux — Adds a rule for Linux systems.
- Edit —
Changes the selected item.
- Delete —
Deletes the selected item.
- Duplicate —
Creates a copy of the selected item.
- Block (only) — Blocks access attempts without logging.
- Report (only) — Logs without blocking access attempts.
- Block and
Report — Blocks and logs access attempts.
- Block All — Selects or deselects
Block for all rules.
- Report All — Selects or deselects
Report for all rules.
To disable the rule, deselect both
Block and
Report.
|