Adaptive Threat Protection — Dynamic Application Containment

You can change whether Trellix-defined containment rules block or report, but you can't otherwise change or delete these rules.

• Block (only) — Blocks, without logging, contained applications from performing actions specified by the rule.
• Report (only) — Logs when applications try to perform actions in the rule, but doesn't prevent applications from performing actions.
• Block and Report — Blocks and logs access attempts.

To block or report all, select Block or Report in the first row.

To disable the rule, deselect both Block and Report.

• Exclude — Moves a contained application to the Exclusions list, releasing it from containment and allowing it to run normally.

• Add — Adds a process to the exclusion list.
• Double-click an item — Changes the selected item.
• Delete — Deletes the selected item.
• Duplicate — Creates a copy of the selected item.