Approved Script Behaviors | Trend Micro Service Central

Views:

If you enable the Operations Behavior Anomaly Detection > Script Behavior function, script behaviors found on the StellarProtect (Legacy Mode) agent-device will be added to its baseline and displayed on the Situaional Awareness > Approved Script Behaviors page. See the following table for more information about the Approved Script Behaviors page.

Table 1. About the Situaional Awareness > Approved Script Behaviors Page
Item	Description
Baseline Toggle	Allows you to determine if you want to include specific approved script behaviors in the baseline. If you turn the toggle off, the target script behaviors will be viewed as unexpected changes; alerts or preventative actions will be triggered depending on the selected Operations Behavior Anomaly Detection mode: In Detect mode: relevant events will be generated. In Enforce mode: target script behaviors will be blocked.
Monitored Process / Script	Displays the monitored operation process containing certain applications and acompanied parameters. By default, StellarProtect (Legacy Mode) monitored 5 applications as listed below. You can also specify other commonly-abused applications in the Operations Behavior Anomaly Detection > Script Behavior > Policy-based Watchlist. powershell.exe wscript.exe cscript.exe mshta.exe psexec.exe See Policy-based Watchlist for more details.
Approved Operation	Displays the approved operations stored in the baseline. The approved operations can be viewed as the full execution process for triggering the monitored process and/or script mentioned above. See Operations Behavior Anomaly Detection for more details.
Added From	Displays the sources the approved script behaviors are added from: Learn mode: the approved script behaviors have been detected and added to the baseline during Operations Behavior Anomaly Detection Learn mode. Event action: the approved script behaviors have been added to the baseline by StellarOne administrator manually from the agent events (by clicking the Add to Baseline action button). See Add to Baseline for more details.
Time Added	Displays the time when the approved script behaviors were added to the baseline.

Note:

TXOne Networks recommends switching back to Operations Behavior Anomaly Detection Learn mode before adding new script behaviors or modifying existing ones.