|Anti-virus and HIPS policy / Behavior monitoring|
For more information, see Managing roles and sub-estates.
Suspicious behavior detection watches all system processes for signs of active malware, such as suspicious writes to the registry or file copy actions. It can be set to warn the administrator and/or block the process.
By default, suspicious behavior is detected and reported, but not blocked.
To change the settings for detecting and reporting suspicious behavior: