cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
mr54
Level 9
Report Inappropriate Content
Message 1 of 6

McAfee TIE and ATP Rule Content Update 1701

Jump to solution

Hello,

I have a question about ATP rule content update 1701.

Rules 266 and 267 are both updated and have the default state "Evaluate". Both changes refer to rule logic to reduce false positives.

But it is specified "if the administrator turns the rule ON" for rule 267.

atp_rules_update.PNG

 

What the difference? If I have not turned on rule 267 (so the rule is in evaluate mode), I won't see any detection improvement? But no matter if I changed the 266 rule state or not, there is a detection improvement?

1 Solution

Accepted Solutions
Saif_f
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

Hi @mr54 ,

Thank you for your post. Rule 267 is enabled (ON) in Security rule group and it is in observe mode in balanced and productivity rule group. Actually even when the rule is in observe mode, it should still have impact in reducing the false positives. 

I think it is just the wording used, as by default when the ATP rule is in observe mode it does not generate any events unless we enable all severity event generation from ENS common policy.

And it is likely mentioned "changes made to rule logic to reduce false positives, if the administrator turns the rule ON", because FP resolve will result in not blocking when rule is ON.

Kind Regards,

 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and give a Kudo, together we can help other members.

View solution in original post

5 Replies
CharlesS
Level 8
Report Inappropriate Content
Message 2 of 6

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

c: Initial Access, Execution, Defense Evasion - Techniques: T1566, T1059. It
is uncommon for cmd.exe to be launched via office documents and can be a sign of
malicious behaviour. It's recommended you enable this rule if your workflows allow for it

yaz
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

H9i @mr54 @CharlesS 

Thanks for reaching out to Community. 

This is recommendation from McAfee and hence we request to turn on rule 267 for enhanced security. 

Was my reply helpful?

If yes, kindly give me a Kudo. 

If I have answered your query, kindly mark this as solution so that we help other community members together. 

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

Evaluate only writes detections to the local log file and I think sends telemetry to McAfee.  Otherwise, it doesn't do you any good unless it is on.

mr54
Level 9
Report Inappropriate Content
Message 5 of 6

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

Hello @TALL @yaz @CharlesS

Thanks for your replies.

In fact, my question is only about the difference between "changes made to rule logic to reduce false positives" and "changes made to rule logic to reduce false positives, if the administator turns the rule ON" in the case of two rules in evaluate mode.

Thanks

mr

Saif_f
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: McAfee TIE and ATP Rule Content Update 1701

Jump to solution

Hi @mr54 ,

Thank you for your post. Rule 267 is enabled (ON) in Security rule group and it is in observe mode in balanced and productivity rule group. Actually even when the rule is in observe mode, it should still have impact in reducing the false positives. 

I think it is just the wording used, as by default when the ATP rule is in observe mode it does not generate any events unless we enable all severity event generation from ENS common policy.

And it is likely mentioned "changes made to rule logic to reduce false positives, if the administrator turns the rule ON", because FP resolve will result in not blocking when rule is ON.

Kind Regards,

 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and give a Kudo, together we can help other members.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community