you should deploy the agents with rule modules you think which matches your security policy. Firewall/Desktop/NetworkShield or whatever. Put them in your own Policy, so its easier to add or remove rule modules later. I prefer making my own rule module too and just use the available rules and of course my own.
But the most important part is to implement them in test mode. (try it on a handful systems) In test mode its easy to see what exceptions you have to make. for example svchost.exe talking to a domaincontroller, needs three exceptions in the network shield rule in my environment. Those exceptions are quiet easy to make with the wizard. just look at the events and the client triggerd "alerts".
The wizard also can generate new application classes if theres an application it don't know yet.
After the fine tuning you can remove the test mode.
Maybe its useful to activate a learning mode afterwards.
