"Continue scanning" Action in On-Demand Scan Policy

[markgarza]

Hi, I inherited our EPO from an ex co-worker some time ago and am just noticing that our servers ODS policy has "Continue scanning" as the action. I have noticed in our alert emails the following:

Event status : Infected file found, access denied

Action: Continue scanning

I am wondering what this means exactly? Was the scanner denied access? And does leaving "continue scanning" as the action mean just leave the threat on the system? If the threat is ever executed, the On-Access Scan should catch that anyway and at that point quarantine the file, correct? I would assume that is the rationale behind this, but I am considering changing it to match our OAS policy actions if that is not the case.

[yaz]

Hi @markgarza 

Thanks for reaching out to community. 

Do you see any of the event ID's for continue scan 

1024, 1026, 1037, 1051, 1053, 1059, 1061,
1095, 1096, 1099, 1100, 1103, 1202, 1203,
1274, 1275, 1276, 1277, 1282, 1283, 1284,
1285, 1289, 1290, 1291, 1292, 1294, 1296,
1298, 1300, 1302, 1304, 1305, 1307, 1308,
1310, 1311, 1400, 1401, 1402, 1404, 1407,
1409, 1411, 1413, 1064, 1065, 1087,
 1088, 1118, 1119, 1120, 1121,

Kindly write back what is the one you see. 

Also we strongly recommend you to raise an SR as there may be multiple issues associated with this and we need to figure out the exact root cause. 

Was my reply helpful?

If yes, please give me a Kudo.

If I have answered your query, kindly mark this as solution so that together we help other community members. 

Was my reply 

[markgarza]

Yes, I am seeing 1024 primarily as the Event ID. 

[yaz]

Hi @markgarza 

Thanks for replying back. 

We needed to carry out further investigation. 

I request you to raise an SR and we can check on the file analysis. 

[Fabian030]

Did you have an outcome here?

We see the same behavior now with some log4j events and the ENS in the latest version.