eEye Digital Security

Overall, I am really liking the 4.0 beta and plan on getting licensing for three computers when this is realeased. However, there are some suggestions I'd like to see added. I'm not the most proficient computer user, I think we all know that from some of the posts I've made. Regardless, here is my very short list.

I'd like to see a checkbox or some other option on the alert notifications that allows me to turn them off. If this could be optional (I'd have to select this during install, or at an initial config screen) that would be great. Why do I ask for this? I'm networking three computers and Vista File Sharing (please see http://forums.eeye.com/forums/t/562.aspx) creates a lot of notifications.

I would also like to see something in the context menu of the log window that allows me to automatically create a rule based on all types of logged events, not just some of them. Why? Because I am not confident that the rules I am creating are the correct ones. Having a template generated by the program and then opening that up for editing would be very helpful.

One thing I really like about the user interface is the fact it is uncluttered. This works well until I need to perform a task and I don't see right off where I need to go. If I can really suggest anything useful here, I hope it is that following Microsofts lead on making everything task based is not a selling point for this program. I would rather have a program that is a tiny bit cluttered yet easy to use, than a squeaky clean one that frustrates me. I am not frustrated yet, this is more of an encouragement to not move anything (like Microsoft and others are so fond of doing) or start renaming things! And please please please do not take the menu bar away! Make sure it is there so people can find it and if it does have an option to be disabled, make it easier to re-activate than "some programs" - I won't mention any names (adobe acrobat).

Finally, is it possible to have the program detect what my LAN IP range / subnet is and not notify me of pings to/from my router? That really is annoying. I also think IMCP (or whatever) should be allowed on the local network, by default.

I'm not sure exactly which notifications you need to stop, but if you mean the little text boxes that appear in the bottom right, if you look for the (/) symbol (no smoking, without the cigarette..) that lets you stop notifications for that rule, or that module.

In this general vein, I would like a summary page where you can easily review the items that are blocked by default for not allowing them within the 45 second limit. I found that my Adobe programs would not update, and that the updater was blocked. It probably checked on it's own when I was not right at the computer, and after that was automatically blocked because no one clicked on "Allow" within the requred time. Give me a list of those items that have been blocked through no affirmative action, and allow me to easily edit that list and easily allow those programs that I do want allowed.

If you enable the Log Denied Traffic option in the Firewall settings page, you will end up with a list of firewall events for all attempts that were denied by the engine. This list can be filtered and examined to aid in creating Firewall rules.

You can just right click on any firewall event and create  rules from the Log viewer itself.