Webroot Journaling and Remidiation/Roll back

Hey @deepak.chow01 

I’ll answer your points here.

1. Sudo exection is where the agent will begin to allow the unknown to run and it starts to very closely watch what the program is doing.
2. The file is executed in a semi-sandbox (meaning it’s regularly executed on the system but not allowed to access system files/processes).
3. Journaling and logging is done by the agent itself in a hidden folder on the system.
4. Once found good, the agent is updated by the cloud to say it’s good and the journaling stops and full execution is permitted.
5. If found bad, the file is terminated and the file quarantined.
6. Yes the user or admin will be alerted once found bad. This usually happens automatically. User CAN change from “monitor” to “allow” or “block” if the program is still being “monitored.”
7. Once a threat is detected, it’s name is changed and it becomes encrypted and moved into a quarantine in a hidden folder on the device. No, once it’s bad, it cannot perform any further actions. 
8. If the agent is able to, after a threat is quarantined, it will attempt to use it’s logs/journals, to revert any changes made to the system.

Some of this is slightly different in terms of user access if you are using the home/commercial product, vs a business version. But the agent itself functions the same.

Hope this helps

Cheers

John H

Reg