"VTP Trusted" but still blocking

[Andy]

Hi everyone,

I am seeing around 50 alerts for various .dll's being executed by mmc, explorer, etc. with the event display name: VTP Trusted.

Description: Application Control blocked this file because it is not in the allow list. To execute this file, add the file to the allow list.

Deny Reason: Local allow list: File not present in allow list

I guess I'm a bit confused by VTP trusted. I was under the reputation that since the file was "Most Likely Trusted", it would be allowed to execute, but the description says it's blocked..

Do I just add these files to my Executable Files list?

Any advice?

[Tares1 · Accepted solution]

Hello @Andy 

Solidcore has an execution decision workflow that will block execution if any check fails, and after checking for TIE and GTI reputation comes VTP and local Whitelist:

You can see all checks that are made by MACC and in what order on this link:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And how Reputation is computed here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And yes adding the files to the executable Files list should allow them to run depending if they don;t fail any other checks as we can see here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

If you still have issues, I would recommend opening a technical support case for further investigation.

[Andy]

Thank you for the info. I'm not 100%, but I'm certain the documentation will get me much further down the road.

It's still pretty interesting to see Solidcore Events under reporting, then see completely different alerts in Policy Discovery under Application Control. Hoping the documentation will explain the differences