First draft

docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx

@@ -249,7 +249,9 @@ register ((elastic-sec)) as your hosts' antivirus software by enabling **Registe
 Windows Server is not supported. Antivirus registration requires Windows Security Center, which is not included in Windows Server operating systems.
 </DocCallOut>
 
-You can also choose **Sync with malware protection level** to automatically set antivirus registration based on how you've configured ((elastic-defend))'s <DocLink slug="/serverless/security/configure-endpoint-integration-policy" section="malware-protection">malware protection</DocLink>. If malware protection is turned on and set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+By default, the **Sync with malware protection level** is selected to automatically set antivirus registration to match how you've configured ((elastic-defend))'s <DocLink slug="/serverless/security/configure-endpoint-integration-policy" section="malware-protection">malware protection</DocLink>. If malware protection is turned on _and_ set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+
+If you don't want to sync antivirus registration, you can set it manually with the **Enabled** or **Disabled** option.
 
 ![Detail of Register as antivirus option.](../images/configure-endpoint-integration-policy/-getting-started-register-as-antivirus.png)