topic Blade Actions Hierarchy in Endpoint

Blade Actions Hierarchy

64Bit — Thu, 17 Sep 2020 12:55:17 GMT

Do the actions in Entire Organisation filter through to other rules?

For example, will the exclusions set in 'Anti-Malware > Scan all files upon access' set for the Entire organisation be applied to the groups within other Anti-Malware rules.

To create a new action the previous shared action has to be cloned. If the actions from Entire organisation are passed down, should we then manually remove each cloned action?

Re: Blade Actions Hierarchy

PhoneBoy — Mon, 21 Sep 2020 05:12:17 GMT

I believe only the most specific rule applies, but @Oren_Shalgi can probably confirm.

Re: Blade Actions Hierarchy

Oren_Shalgi — Tue, 29 Sep 2020 09:25:39 GMT

Hi,

Endpoint policy follows a first-match concept, with Entire Organization being the last one that is being matched.

In SmartEndpoint we have the shared action concept so you can re-use the same action and its settings on different rules.

You have indication of the name in bold when the action on that rule is different than the one for Entire Organization.

In the example above the setting that will enforced on group CAD are those that are defined in "Scan all files upon access CAD". If you make changes to "Scan all files upon access" you should do the same changes on "Scan all files upon access CAD" for them to apply, or change the action on that rule to "Scan all files upon access".

Hope it is clearer.

Oren.