Maybe a MVP would like to comment as they could have more official details
but the way I see them is this:
Red - Threats to the system and are always blocked from running or
installing untill the user makes a choice if they can proceed.
Blue - Not In the MS database as a threat but has potential for damage also
monitors system changes based on the Real Time checkpoints and they are also
blocked untill the user chooses if they should be allowed
Green - Spyware Free applications or system changes that are known to be
safe, the pop ups are just to inform the user of a change on the system and
do not get stopped
Orange - Items that have been previously blocked so are denied permission to
run or make changes next time they are detected untill they are removed from
the blocked list
Regards
Andy