cancel
Showing results for 
Search instead for 
Did you mean: 

ATP Threat Detection User Messaging concerns

Jump to solution

Hi,

We want to activate the advance feature of Displaying a threat notification to users when using ATP. While reading documention on this, we noticed that Users can ALLOW any action that they are prompted with in regards to what triggers the notification. As an example, we would set the Rule Assignment to Balanced and the Triger for DAC is Might be Malicious. We want the user to be notified that there could potentialy be a malicious software that is trying to run on their PC.

Unfortunately, they would have the option to ALLOW the software to run uncontained even though we want the software to run in DAC.

Is there a way just to notify the user of an ATP event without letting him decide what to do with the possible malicious event? We want the user to be aware of the situation, but not able to overide McAfee functionnality.

Thanks

M. Lacroix

1 Solution

Accepted Solutions
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: ATP Threat Detection User Messaging concerns

Jump to solution

The only options you have for ATP user messages are found within the ENSATP Options policy.

Here you select to display the message, what message is displayed and the default action of allow or block. As far as I am aware, there is no option to just merely display the message without any actions.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
1 Reply
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: ATP Threat Detection User Messaging concerns

Jump to solution

The only options you have for ATP user messages are found within the ENSATP Options policy.

Here you select to display the message, what message is displayed and the default action of allow or block. As far as I am aware, there is no option to just merely display the message without any actions.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator