Hello everyone,
I am trying to clean files which reputations are manually imported in ePO but ATP module of ENS cannot enforce action on them. I am using the action enforcement as Clean when reputation threshold reaches: Known Malicious.
Here is an interesting log from ENS Platform error log:
01/18/2018 04:56:51.523 PM mfeatp(2932.1020) <SYSTEM> Orchestrator.JCM.Error (jcm_native.cpp:911): Failed to finalize reputation for file C:\PROGRAM FILES\TRANSMISSION\TRANSMISSION-QT.EXE. ErrorCode 0xc030002f
By the way, I am sure TIE and ATP is working because when I change another file's reputation it enforces action. Here is the log from Adaptive Threat Protection Activity:
2/5/2018 8:56:10 AM mfeatp(2820.12832) <SYSTEM> Orchestrator.Action.Activity: Action Taken on File C:\USERS\USER\DOWNLOADS\MINIWEB-WIN32-20130309\MINIWEB\MINIWEB.EXE with reputation 1 is: Clean
Any ideas? I have already created service requests for this issue but no imporvement yet.
Thanks