Prioritizing Recorder rules

Recorder policy rules are prioritized, and the SEP agent interprets the rules in priority order.  
Disable monitoring
rules are not monitored, recorded, or submitted to Symantec EDR.  So they are assigned priority 0.  You can have multiple
Disable monitoring
rules, all assigned priority 0.  Disable monitoring rules also take precedence over all monitor rules, so they all appear at the top of the rule list.
Symantec EDR applies the next sequential priority to all the other rule types when you create them.  Newly created recorder rules receive the next sequential priority number.  But you can change the priorities.  When you move a recorder rule priority up or down, all subsequent recorder rules are renumbered accordingly. 
For example, assume you have a
Do not record
rule as priority 1; a
Record do not submit
rule as priority 2; and a 
Record and submit
rule as priority 3.  If you move the
Record and submit
rule to priority 1, then the
Do not record
rule changes to priority 2; and the
Record do not submit
rule changes to priority 3. 
When a recorder rule is deleted, all subsequent rules move up in priority.
  1. On the
    Policies > Recorder
    tab, do any of the following tasks:
    • In the
      column, click on the priority number that you want to change. Click the edit icon (pencil).  Type the new priority number.  Click the check mark to save your change.
    • On the far right of the row for the rule type that contains the priority you want to change, click the action menu (three vertical dots). Select either
      Move Up
      Move Down