Configuring the actions to take when a condition is met
|Article:HOWTO27031|||||Created: 2010-01-08|||||Updated: 2010-01-15|||||Article URL http://www.symantec.com/docs/HOWTO27031|
A best practice is to use the Block access action to prevent a condition rather than to use the Terminate process action. The Terminate process action should be used only in advanced configurations.
To configure the actions to take when a condition is met
For the Launch Process Attempts condition and the Terminate Process Attempts condition, click one of the following options: Continue processing other rules, Allow access, Block access, or Terminate process.
For the Registry Access Attempts condition and the File and Folder Access Attempts condition, you can configure two sets of actions. One set applies when there is a read attempt; the other set applies when there is a create, delete, or write attempt.
Article URL http://www.symantec.com/docs/HOWTO27031