In the Behavior Blocker settings you have: detect programs which require elevated privileges e.g. installers or updaters, show privilege alerts for unknown programs and define exceptions for behavior blocking. Do I leave all these enabled? :P0l
“detect programs which require elevated privileges e.g. installers or updaters”
Means that every time you run a installer or updater that is unknown to CIS, you will get an alert. Keep it checked to get the alert and decide what you what to do with the installer or updater. If unchecked, CIS will do the action specified in your Behavior blocker (Partially Limited, Limited, etc.) to that application.
“show privilege alerts for unknown programs” is basically the same thing as “detect programs which require elevated privileges e.g. installers or updaters” but, it alerts for executable’s rather than just unknown installers and updaters. Also, if you disable the first option “detect programs which require elevated privileges e.g. installers or updaters” this will get greyed out.
“define exceptions for behavior blocking” means that any program type like .exe, .jar, or .bat can be put in here and if run and unknown to CIS, you won’t get an alert and it would get restricted by the BB either. This is not recommended for you to change unless you are a software developer and are running multiple types of .exe’s uknown to CIS.
If you still have more questions, click on the Question mark “?” at the upper right hand corner of the CIS settings window to gain more information about CIS options and CIS it’s self.