Prioritizing Recorder rules
Recorder policy rules are prioritized, and the SEP agent interprets the rules in priority order.
Disable monitoringrules are not monitored, recorded, or submitted to Symantec EDR. So they are assigned priority 0. You can have multiple
Disable monitoringrules, all assigned priority 0. Disable monitoring rules also take precedence over all monitor rules, so they all appear at the top of the rule list.
Symantec EDR applies the next sequential priority to all the other rule types when you create them. Newly created recorder rules receive the next sequential priority number. But you can change the priorities. When you move a recorder rule priority up or down, all subsequent recorder rules are renumbered accordingly.
For example, assume you have a
Do not recordrule as priority 1; a
Record do not submitrule as priority 2; and a
Record and submitrule as priority 3. If you move the
Record and submitrule to priority 1, then the
Do not recordrule changes to priority 2; and the
Record do not submitrule changes to priority 3.
When a recorder rule is deleted, all subsequent rules move up in priority.
- On thePolicies > Recordertab, do any of the following tasks:
- In thePrioritycolumn, click on the priority number that you want to change. Click the edit icon (pencil). Type the new priority number. Click the check mark to save your change.
- On the far right of the row for the rule type that contains the priority you want to change, click the action menu (three vertical dots). Select eitherMove UporMove Down.