1 - Definition
Absorption mode is the default mode activated when the agent is installed. It consists of absorbing a user's usage of the Endpoint; in fact, it is a learning mode that lists all the user's business usage in order to create security rules.
Each new rule is automatically added to the "Absorption" application, which is empty by default.
2 - Recommendation
It is recommended to activate the absorption mode for one week after deployment on the machines, in order to absorb the behaviour of the software used by the users. During this phase, it is recommended to disable user notifications, in order to be transparent to users. This feature is only available in "Alert" mode, so machines are not protected and no notification is sent to administrators.
Once the rules have been checked and sorted, the policy can be configured in protection mode.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article