cancel
Showing results for 
Search instead for 
Did you mean: 

Make policy to exclude process from triggering by ENS in ePO

Jump to solution

Hi.

I have event that triggered by ENS ATP:

c1ab3cf5-5428-4f6d-a9da-da8f80966d22.png

I know that I can exclude it by path and md5 hash. But how to do it based on best practice via deploying policy to ENS by ePO?

1 Solution

Accepted Solutions
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

@Schopenhauer 

 

The ATP rule being triggered is rule ID 255, which is rule 19 in the execution order.  This is being flagged as part of Real-Protection Static content analysis.  This cannot be excluded by MD5 hash, but there are a couple of options:

1.  ATP will honor the file/folder exclusions entered within the ENS On-Access Scan policy, under the Standard tab.  For example, if we want ATP to never monitor process execution of DropBox.exe, then we can add DropBox.exe as a file exclusion within this ENS policy.  ATP will only honor the Standard exclusions, and not what is entered within the Low or High-risk settings.

2.  Within ePO's Menu, select Server Settings, and then click on Adaptive Threat Protection.  Here, you can view all of the static rules used for behavioral analysis, in this case rule ID 255.  These rules can be edited, and enabled/disabled as needed.  Since the rule being violated is always set to "Observe," it will not block even when disabling Observe mode within the ATP policies.

If the environment wishes to not see these specific violations, and doesn't want ATP to report (observe) on this specific rule analysis, it can disabled the rule.  However, this will disable the rule entirely.  What might be more beneficial from a security perspective, is to just exclude the file which is executing the process that is violating the rule, provided that the process is trusted.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

2 Replies
Reliable Contributor tao
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

Consider reviewing McAfee Endpoint Security 10.6.0 - Adaptive Threat Protection Product Guide - It does list several ATP best practices:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27592/en_US/...

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Make policy to exclude process from triggering by ENS in ePO

Jump to solution

@Schopenhauer 

 

The ATP rule being triggered is rule ID 255, which is rule 19 in the execution order.  This is being flagged as part of Real-Protection Static content analysis.  This cannot be excluded by MD5 hash, but there are a couple of options:

1.  ATP will honor the file/folder exclusions entered within the ENS On-Access Scan policy, under the Standard tab.  For example, if we want ATP to never monitor process execution of DropBox.exe, then we can add DropBox.exe as a file exclusion within this ENS policy.  ATP will only honor the Standard exclusions, and not what is entered within the Low or High-risk settings.

2.  Within ePO's Menu, select Server Settings, and then click on Adaptive Threat Protection.  Here, you can view all of the static rules used for behavioral analysis, in this case rule ID 255.  These rules can be edited, and enabled/disabled as needed.  Since the rule being violated is always set to "Observe," it will not block even when disabling Observe mode within the ATP policies.

If the environment wishes to not see these specific violations, and doesn't want ATP to report (observe) on this specific rule analysis, it can disabled the rule.  However, this will disable the rule entirely.  What might be more beneficial from a security perspective, is to just exclude the file which is executing the process that is violating the rule, provided that the process is trusted.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator