To access the Audit Report:

1. Within your VIPRE Cloud web console, under Monitor, select Reports
2. Choose Audit Report
3. You will be presented with a filterable table that includes the time the action took place, the user who performed the action, the action that was performed, the target of that action, and whether or not the action was successful
   1. In Site Manager, you will also see a column indicating which site the action was performed on         

1. From within the VIPRE Cloud web console, under Manage, select Devices
2. Filter your devices as desired; each page shows 25 devices
3. Under the table headers, you should see the option to select all devices based on your filter - click Select all nn devices based on filter
   • This will change to say All nn devices based on filter are selected
4. Click Actions in the top-right portion of the screen and select Isolate from Network or Unisolate from Network

1. From within the Site Manager web console, under SETUP, select System, then choose Notifications
2. In the top right, click the Add Notification button
3. A window will pop up; complete the following information:
   • Name of your notification
   • Type: select Incident Detected
   • Severity can be low, medium, or high
   • Remediation Status can be auto-remediated or unhanded
   • Recipients determine who will receive the email notification
   • Subject can be customized to include tokens, incident id, hostname, site, device alias, or policy name
   • Scope can either be Global or by Site; when choosing Site, you then have the option to use a singular site or multiple sites
4. After configuring the notification to your liking, select Preview to see a staged draft of what the email will look like, or click Add Notification

AMSI is enabled with Block and disinfect selected by default.

To enable/disable AMSI:

1. Within your VIPRE Cloud web console, under Manage, select Policies
2. Choose the desired policy, then click Active Protection and scroll down until you see AMSI
3. Add a checkmark next to Enable malicious script blocking with Microsoft AMSI protection and select one of the following actions:
   • Allow - detects and reports the events but does not block the action
   • Block - detects and reports the events and blocks the script
   • Block and disinfect - detects and reports the events, blocks and removes the script

To view AMSI detection events:

1. Within the VIPRE Cloud web console, under Monitor, select Reports
2. Click Threat Summary Report
3. Select and click on the name of a threat in the table at the bottom of the page
4. Click the device name in the Detections table
5. In the light blue side-navigation bar, select Threats
6. Filter to choose AMSI then click on a threat to show the details
7. If you want to add an exclusion for a particular threat, click the Add to Exclusion link

Exploit Protection is enabled with Terminate selected by default.

To enable Exploit Protection:

1. Within your VIPRE Cloud web console, under Manage, select Policies
2. Choose the desired policy, then click Active Protection and scroll down until you see Exploit Protection
3. Add a checkmark next to Enable detection and blocking of program exploitation attempts and select one of the following actions:
   • Allow - detects and reports exploitation attempts but does not block the action
   • Block - detects and reports exploitation attempts and blocks the action but does not halt the offending process
   • Kill - detects and reports exploitation attempts, blocks the action, and kills the offending process

To view Exploit Protection events:

1. Within the VIPRE Cloud web console, under Monitor, select Reports
2. Click Threat Summary Report
3. Select and click on the name of a threat in the table at the bottom of the page
4. Click the device name in the Detections table
5. In the light blue side-navigation bar, select Threats
6. Filter to choose Exploit then click on a threat to show the details
7. If you want to add an exclusion for a particular threat, click the Add to Exclusion link

Tamper Protection is enabled by default. To disable Tamper Protection:

1. Within your VIPRE Cloud web console, under Manage, select Policies
2. Choose the desired policy, then click Agent and scroll down until you see Tamper Protection
3. Remove the checkmark next to Enable Tamper Protection 

Tamper Protection is now disabled.

Ransomware Protection is enabled with Monitor network share paths selected by default.

To enable Ransomware Protection:

1. Within your EDR web console, under Manage, select Policies
2. Choose the desired policy, then click EDR and scroll down until you see Ransomware Protection
3. Add a checkmark next to Enable ransomware protection to rollback files encrypted by ransomware as soon as VIPRE detects and blocks the attack
   • Check whether you want it to Monitor network share paths

To view Ransomware Protection events:

1. Within the EDR web console, under Monitor, select Reports
2. Click Threat Detection Report
3. Select and click on the name of a threat in the table at the bottom of the page
4. Click the device name in the Detections table
5. In the light blue side-navigation bar, select Threats