Configure Anti-Ransomware Protection

From the ESM Console, select
Policies
Malware
Protection Modules
.
Select the
Windows
tab.
Select
Add
Anti-Ransomware Protection
and then configure the rule settings.
Activation
—Select
On
to enable anti-ransomware protection or
Off
to disable protection. In situations where disk encryption software must encrypt files, consider configuring a rule to disable protection on that process.
Action
—Select the action to take when Traps detects an attempt to encrypt protected files: Select
Prevention
(recommended) to block the process from encrypting the files. To permit a specific process (such as disk encryption software) to encrypt files, select
Notification
. In notification mode, Traps logs the issue but does not block the encryption activity. Alternatively, you can choose to
Inherit
the behavior from the preceding rule in the rule hierarchy.
User Alert
—Specify the notification behavior when a process attempts to encrypt files, either
On
to notify the user, or
Off
to suppress notifications. Alternatively, you can choose to
Inherit
the behavior from the preceding rule in the rule hierarchy.
Select the
Processes
tab and
Add
one or more source processes to which Traps will apply anti-ransomware process protection.
As you type, the ESM Console provides auto-completion based the list of processes defined in the ESM Console.
If you do not specify a process, the rule applies to all processes.
(
Optional
) Add Conditions to the rule. By default, a new rule does not contain any conditions.
To specify a condition, select the
Conditions
tab, select the condition in the Conditions list, and then
Add
it to the Selected Conditions list. Repeat this step to add more conditions, as needed. You can also define new Conditions.
(
Optional
) Define the Target Objects to which to apply the rule.
To define a smaller subset of target objects, select the
Objects
tab, and then enter one or more
AD Users
,
AD Computers
,
AD Groups
,
AD Organizational Unit
,
Existing Endpoints
, or
Existing Groups
in the Include or Exclude areas. The Endpoint Security Manager queries Active Directory to verify the users, computers, groups, or organizational units. The ESM Console also offers autocompletion as you type for existing endpoints and existing virtual groups.
(
Optional
) Review the rule name and description. The ESM Console automatically generates the rule name and description based on the rule details but permits you to change these fields, if needed.
To override the autogenerated name, select the
Name
tab, clear the
Activate automatic description
option, and then enter a rule name and description of your choice.
To save the rule, do either of the following:
Save
the rule and
Activate
it later from the rule management page.
Apply
the rule to activate it immediately. The ESM Server distributes the rule at the next heartbeat communication with the agent.
After saving or applying a rule, you can return to the
Policies
Malware
Protection Modules
page at any time to
Delete
or
Deactivate
the rule.
To view security events triggered by the Anti-Ransomware Protection MPM, see the
Malware Modules
pages:
Prevention events—
Security Events
Preventions
Malware Modules
.
Notification-only events—
Security Events
Notifications
Malware Modules
.
Each security event identifies the source process and the location of the target file.