Easy Way to Access/Retrace HIPS Decision (Log -> Rules)


I think adding an easy way to access or communicate between LOG and HIPS Rules would be a great addition to CIS.

The idea is : when you forget to untick the box “Remember this action in the future” and you chose “Block and Terminate” (let’s you didn’t wanted CIS to Sandbox it in the first place), well it’s a pain to go back in the settings and find back which file you blocked.

Not because I’m dumb or anything, but take STEAM for example :

a) Some Steam Services Launch something

b) Sometimes the game has a Launcher which launches the game

c) You can find many other situations like that depending on the software you work with


P.S. I know exclusion exists, but I’m thinking from specific to general …

This brings me to related posts :

1- FW & HIPS Rules : Filter As You Search :

2- Prevent UI to overlap the entry in Rules.

Thanks very much. Could you clarify exactly how you think this would work?


I would suggest to see the image and :

1 - Adding a new category in the event log where it would precise if the box “Remember this action” was ticked

2- Communication between Event Log and HIPS / Sandbox / FW Rules → Double click or Right Click on the event so that it would lead you to the right to the rule in question and you could Modify / Delete depending on what you want to do …

This would really simplify the process. :slight_smile:

[attachment deleted by admin]

OK makes sense thanks for explaining


:-TU :-TU :-TU