Does having "Preform Recommended Actions Automatically" make anything 'Ask User' in HIPS just automatically yes?

[Guest]

Is this true?

 

[Xzz123]

how to make HIPS ask you what to do

1. unselect auto mode and set hips rule as ASK

2. if you set camera protecion rules as ask, than it always ignore auto or interactive mode. it will always pop up notification.

If you select auto mode→

ASK settings in hips rule do not apply and it always allow actions→

ASK = Allow in auto mode

and Deny = Deny in auto mode. allow =allow in auto mode.

except for camera protection and advanced disinfection pop up

Edited June 14, 2023 by Xzz123

[Guest]

Is there any way for it to do everything for me? Like make the decisions for me and make smart decisions, not just yes?

[Xzz123]

14 hours ago, Xeno2ig said:

Is there any way for it to do everything for me? Like make the decisions for me and make smart decisions, not just yes?

Kaspersky has no semi-automatic mode.

I myself use auto mode+custom made Deny rules

[Guest]

Firstly, what is your current setup

Secondly,  any way I could suggest a feature to make automode use AI or other things to block suspicious behavior?

[Xzz123]

On 6/24/2023 at 9:29 AM, Xeno2ig said:

what is your current setup

I mainly use HIPS to block application in low and high restricted group to perform following:

inject code into another process

read memory of another process

access to windows acount settings

shutdown windows

access to camera and microphone.

Kaspersky's behavior detection do not block single risky actions, it is different from some vendor like EMSISOFT.

currently there is no way to make HIPS module or System watcher to bolck single risky behavior without your own rules. sadly.

just like many big vendor, such fully automatic behavior detection is the trend now in 2020s year. bitdefender&norton&trendmicro&AVG etc.

 

On 6/24/2023 at 9:29 AM, Xeno2ig said:

Firstly, what is your current setup

Secondly,  any way I could suggest a feature to make automode use AI or other things to block suspicious behavior?

If I remember correctly

12+years ago, K's first generation of behavior detecion, named as proactive defense, has such single step detection and block fuction. But unfortunately the product made too many false positive and got many complains in those old days.

now with System Watcher - the second generation(at least in base folder it is called sw2) of proactive defense user will get more accurate detections and very much low false positive ratio.