In the CIS access prompts, I’d like the ability to put the application in question, and optionally its child processes, into Training Mode without enabling it globally.
The existing Training Mode has its uses; if you’ve just set up your PC, or you’ve blown away your CIS config in order to start over, then you can just flip on Training Mode and CIS will learn the current state of your box. What I don’t like about the existing Training Mode is that it feels way too permissive for learning individual applications; if, for some reason, something nasty or undesirable decides to run while Training Mode is enabled, CIS is not only capturing the behavior of the program you’re trying to run, but those potentially nasty applications’ behaviors as well.
Granted, you can always turn off Training Mode afterward, check for and kill the offending applications, then go trim and tweak the rules, but the HIPS rules UI is freakin’ BURIED, seven clicks deep (Assuming you already know where they are), in a UI that’s a PITA to navigate (Sorry, Comodo. We can talk about your design language another time).