Wide is highly sensitive and errs on the restrictive side; it detects more data than the other levels. It is more likely to produce a false positive (unintended match) than a false negative (content that is not detected).

Default balances the number of false positives and false negatives and is recommended for most customers.

Narrow is the least restrictive. It is more likely to let content through than to produce an unintended match. For best practice, use this level when you first start using the block action. You might also use it if the system is detecting too many false positives.

Suspected malware communication - Identifies transactions that are suspected to be malicious, based on analysis of traffic of known infected machines. This includes traffic thought to be malware phoning home or attempting to steal data. To use this feature, you must have TRITON AP-WEB installed and the Linking Service enabled. Because Linking Service is required, malware is not detected on endpoints.

Encrypted files - unknown format - Searches for outbound files that were encrypted using unknown encryption formats, based on advanced pattern and statistical analysis of the data.

Encrypted files - known format - Searches for outbound transactions comprising common encrypted file formats, such as password-protected Microsoft Word files.

Password files - Searches for password files, such as a SAM database and UNIX/Linux password files.

Common password information - Searches for password information in plain text by looking for common password patterns and using various heuristics.

IT asset information - Searches for electronic data containing suspicious content, such as network data, software license keys, and database files.

Suspicious behavior over time - Searches for activity considered to be potentially malicious, such as numerous posts in a designated period or numerous transactions containing encrypted data.

Wide is highly sensitive and errs on the restrictive side; it detects more data than the other levels. It is more likely to produce a false positive (unintended match) than a false negative (content that is not detected).

Default balances the number of false positives and false negatives and is recommended for most customers.

Narrow is the least restrictive. It is more likely to let content through than to produce an unintended match. For best practice, use this level when you first start using the block action. You might also use it if the system is detecting too many false positives.