Documentation written from the code, not from the sales brochure.

1. 1

   Prefer hash or full-path exclusions over file-name exclusions. A name can be reused; a SHA-256 cannot.

2. 2

   For a build folder, exclude the artifacts subfolder, not the project root. The root also contains scripts you do want to see.

3. 3

   Exclusions for the network engine are not inherited from the file engine. They are separate lists on purpose — a URL is not a file.

4. 4

   Review the list once a quarter. A forgotten exclusion is more dangerous than one you remember.

1. 1

   On detection the file is moved to data/quarantine/ and encrypted with a key derived from the SHA-256 of its content, a random 12-byte IV and a 16-byte tag.

2. 2

   Metadata (original path, hashes, detections) stays in SQLite. The original file is deleted from disk, not just renamed.

3. 3

   Restore verifies the GCM tag before writing anything. If the blob was modified, the operation is refused, not “almost successful”.

4. 4

   The legacy DQ1 (XOR) format is still readable, so older installations do not end up with inaccessible files.

1. 1

   chokidar walks the Downloads, Desktop and Documents trees at start-up. Events appear after this 10–12 second window.

2. 2

   Choose the action on detection: report (notify the dashboard only) or quarantine (move the file to encrypted quarantine). Report is less destructive, quarantine is safer on shared endpoints.

3. 3

   Events flow through SSE to the dashboard, so there is no need to reload. The live monitor shows the connection state.

4. 4

   Files in watched folders are scanned with deep: false. If you want deep analysis on a specific file, start an explicit scan on it.

1. 1

   Plant canary files in the folders that matter. They are harmless files no legitimate process should touch.

2. 2

   The check runs every 60 seconds. A modified or deleted canary raises an event, not a blind reaction.

3. 3

   The threshold of 40 writes in a short window is the “burst” signal. Below it, behaviour is considered normal.

4. 4

   Rollback is manual, from the pre-write copies. We do not automatically overwrite your files based on a heuristic — restoring is your decision.

Note: Ransomware guard does not replace a backup. It is a net for the first minutes, not a recovery strategy.

1. 1

   Start with strings, not complex conditions. A rare, long needle is worth more than three clever conditions.

2. 2

   Use wide for Windows binaries and nocase only where the vendor actually varies case. nocase on the whole string widens matches a lot.

3. 3

   Add filesize as an escape filter, not an entry filter. The prefilter already decides which files reach the rule.

4. 4

   Test the rule on a corpus that includes legitimate files. A rule that catches the sample and three signed installers is a lost rule.

5. 5

   Set meta.severity correctly: critical or high pushes the score over the threshold. A “medium” rule cannot produce a malicious verdict on its own.

6. 6

   Drafts generated by the AI analyst are never auto-installed. You read them, test them, then put them on disk.

1. 1

   SIEM is disabled by default. You enable it explicitly, with destination, protocol and format — there is no background sending you did not ask for.

2. 2

   The queue is bounded at 512 events. If the destination does not respond you lose old events, not process memory.

3. 3

   The audit log is append-only: it cannot be edited or deleted from the application. For compliance, export it periodically.

4. 4

   Roles are admin, analyst and viewer. Tokens are stored as SHA-256, never in clear text, and passwords use scrypt with a salt.

1. 1

   Open %ProgramData%\Malnox\logs\setup.log. If the folder does not exist yet, try %TEMP%\MalnoxSetup.log.

2. 2

   Look for the Windows error code in the log. 1639 means invalid command line; 1072 means the service is marked for deletion; 5 means access denied.

3. 3

   If the port is taken, the installer tells you the process name and PID. Close it or let the installer pick another port in 4711–4730.

4. 4

   Run again with --silent --keep-payload to keep the extracted archive for diagnostics.

1. 1

   Copy MalnoxSetup.exe onto the target machine. It needs no internet: the runtime, engines and rules are inside.

2. 2

   Generate the activation file from the dashboard on a connected machine and import it locally. The file is valid for a single device.

3. 3

   Intel packages are HMAC-SHA256 signed, with atomic staging and rename. Path traversal is explicitly rejected.

4. 4

   Signature updates are carried as files and imported locally. There is no “it fetches signatures from the server when it can”.

1. 1

   The GDPR policy has a threshold of 3 matches; PCI-DSS validates card numbers with Luhn and marks them critical when they pass; secrets use 70, HIPAA 62.

2. 2

   Confidential documents are a separate category, disabled by default. Enable it only if you understand what it means for noise volume.

3. 3

   Results appear in the dashboard as findings, not automated actions. Local DLP reports, it does not block business flows.

4. 4

   There is no cloud classification service. All matches are computed on the local file with the bundled rule engine.