OfficeScan 10 Administrator's Guide - Online Help Home - Trend Micro

Behavior Monitoring
Protecting Computers from Security Risks
OfficeScan constantly monitors computers (or endpoints) for unusual modifications to
the operating system or on installed software. Administrators (or users) can create
exception lists that allow certain programs to start despite violating a monitored change,
or completely block certain programs. In addition, programs with a valid digital
signature or have been certified are always allowed to start.
Note: To help ensure that this feature does not interfere with critical applications,
OfficeScan leaves this feature disabled on server platforms, even when it is enabled
through the console. To enable this feature on a server computer, manually modify
registry settings on that computer. For instructions, refer to Post-installation
Considerations on page 3-57.
To manage behavior monitoring settings:
PATH: NETWORKED COMPUTERS > CLIENT MANAGEMENT > SETTINGS > BEHAVIOR MONITOR-
ING SETTINGS
1. From the Behavior Monitoring screen, update the following as required:
Note: OfficeScan automatically enables Malware Behavior Blocking and disables Event
Monitoring.
• Enable Malware Behavior Blocking: Select this option to enable program
behavior monitoring for proactive detection of malware and similar threats.
• Enable Event Monitoring: Select this option to monitor system events that
may introduce threats/security risks into the computer and then select an
action for each system event:
Tip: Trend Micro recommends enabling Certified Safe Software Service to reduce the
likelihood of false positive detections. See To enable Certified Safe Software Service: on
page 5-69.
• Assess: Always allow processes associated with an event but record this
action in the logs for assessment
• Allow: Always allow processes associated with an event
5-65