cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Make policy to exclude process from triggering by ENS in ePO

Jump to solution

Hi.

I have event that triggered by ENS ATP:

c1ab3cf5-5428-4f6d-a9da-da8f80966d22.png

I know that I can exclude it by path and md5 hash. But how to do it based on best practice via deploying policy to ENS by ePO?

1 Solution

Accepted Solutions
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

@Schopenhauer 

 

The ATP rule being triggered is rule ID 255, which is rule 19 in the execution order.  This is being flagged as part of Real-Protection Static content analysis.  This cannot be excluded by MD5 hash, but there are a couple of options:

1.  ATP will honor the file/folder exclusions entered within the ENS On-Access Scan policy, under the Standard tab.  For example, if we want ATP to never monitor process execution of DropBox.exe, then we can add DropBox.exe as a file exclusion within this ENS policy.  ATP will only honor the Standard exclusions, and not what is entered within the Low or High-risk settings.

2.  Within ePO's Menu, select Server Settings, and then click on Adaptive Threat Protection.  Here, you can view all of the static rules used for behavioral analysis, in this case rule ID 255.  These rules can be edited, and enabled/disabled as needed.  Since the rule being violated is always set to "Observe," it will not block even when disabling Observe mode within the ATP policies.

If the environment wishes to not see these specific violations, and doesn't want ATP to report (observe) on this specific rule analysis, it can disabled the rule.  However, this will disable the rule entirely.  What might be more beneficial from a security perspective, is to just exclude the file which is executing the process that is violating the rule, provided that the process is trusted.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

2 Replies
Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

Consider reviewing McAfee Endpoint Security 10.6.0 - Adaptive Threat Protection Product Guide - It does list several ATP best practices:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27592/en_US/...

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

@Schopenhauer 

 

The ATP rule being triggered is rule ID 255, which is rule 19 in the execution order.  This is being flagged as part of Real-Protection Static content analysis.  This cannot be excluded by MD5 hash, but there are a couple of options:

1.  ATP will honor the file/folder exclusions entered within the ENS On-Access Scan policy, under the Standard tab.  For example, if we want ATP to never monitor process execution of DropBox.exe, then we can add DropBox.exe as a file exclusion within this ENS policy.  ATP will only honor the Standard exclusions, and not what is entered within the Low or High-risk settings.

2.  Within ePO's Menu, select Server Settings, and then click on Adaptive Threat Protection.  Here, you can view all of the static rules used for behavioral analysis, in this case rule ID 255.  These rules can be edited, and enabled/disabled as needed.  Since the rule being violated is always set to "Observe," it will not block even when disabling Observe mode within the ATP policies.

If the environment wishes to not see these specific violations, and doesn't want ATP to report (observe) on this specific rule analysis, it can disabled the rule.  However, this will disable the rule entirely.  What might be more beneficial from a security perspective, is to just exclude the file which is executing the process that is violating the rule, provided that the process is trusted.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community