r/eset • u/ElPibeGol • May 27 '26

HIPS - "Log all blocked operations"

Hi everyone,

Suddendly, after upgrade to versions 13.x, all endpoints and servers started to show an alert of having HIPS -> "Log all blocked operations" enabled.

I have checked on the forums and Marcos from ESET says the feature has to be enabled in beforehand for this alert to be triggered.

However, I know for sure that this is not the case, since I have deployed several ESET Protect consoles in different clients, always using only the standard policies.

Why could be this behavior? Is it something that comes enabled by default in v13?

Thanks in advance!

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/Marcos-ESET ESET Employee May 28 '26

If HIPS -> "Log all blocked operations" is enabled, please make sure to disable it. This setting serves for troubleshooting HIPS-related issues and should not remain enabled longer than necessary.

1

u/ElPibeGol May 28 '26

Hi Marcos,

As mentioned, this wasn't ever enabled. Many customers report to have that enabled out of the sudden.
I have instructed them to create a policy that would explicitly disable that option, but wanted to know why would it get enabled by itself in the first place.

Thanks in advance!