You can monitor files, directories, registry keys, users, and programs.
Element | Tracked operations |
|---|
File | File creation File change (file content and attributes, such as permissions, owner, or group) File deletion File rename Alternate Data Stream creation Alternate Data Stream change (content and attributes, such as permissions or owner) Alternate Data Stream deletion Alternate Data Stream rename
|
Process | Process start Process stop
|
Registry key | Registry key creation Registry key change Registry key deletion
|
User account | User account tracking is disabled by default. You must enable this feature to track operations for user accounts. To enable this feature, execute the SC: Run Commands client task to run the sadmin features enable mon-uat command on the endpoint.
|
Change Control includes predefined monitoring rules.
Order of precedence for monitoring rules
This is the order of precedence applied (highest to lowest) when processing monitoring rules.
Advanced exclusion filters (AEF) rules
Exclude rules
Rules based on user name
Rules based on program name
Rules based on file extension
Rules based on file names or paths