combm

Behavior Monitoring Components

Behavior Monitoring Detection Pattern

This pattern contains the rules for detecting suspicious threat behavior.

Behavior Monitoring Driver

This kernel mode driver monitors system events and passes them to the Behavior Monitoring Core Service for policy enforcement.

Behavior Monitoring Core Service

This user mode service has the following functions:

• Provides rootkit detection

• Regulates access to external devices

• Protects files, registry keys, and services

Behavior Monitoring Configuration Pattern

The Behavior Monitoring Driver uses this pattern to identify normal system events and exclude them from policy enforcement.

Digital Signature Pattern

This pattern contains a list of valid digital signatures that are used by the Behavior Monitoring Core Service to determine whether a program responsible for a system event is safe.

Policy Enforcement Pattern

The Behavior Monitoring Core Service checks system events against the policies in this pattern.

See also:

• OfficeScan Components and Programs

• Update Overview