cancel
Showing results for 
Search instead for 
Did you mean: 
ycf
Level 7
Report Inappropriate Content
Message 1 of 6

Quarantine list

Hi,

Everytime I upgrade the manager it deletes my quarantine list. The IPs are there for a reason and I want to blacklist them for good. how can I keep the quarantine list after upgrades so they will be blocked?

 

Thanks

5 Replies
Reliable Contributor mjesmer
Reliable Contributor
Report Inappropriate Content
Message 2 of 6

Re: Quarantine list

I would contact support, this shouldn't get deleted when you upgrade. 

 

I recall an issue like this on previous versions of NSM.

 

What version were you on?

What are you on now?

Reliable Contributor mjesmer
Reliable Contributor
Report Inappropriate Content
Message 3 of 6

Re: Quarantine list

Any luck with support on this issue?

ycf
Level 7
Report Inappropriate Content
Message 4 of 6

Re: Quarantine list

No luck what so ever, they claim this is a temporary database. I can't understand the logic behind this. 

Reliable Contributor mjesmer
Reliable Contributor
Report Inappropriate Content
Message 5 of 6

Re: Quarantine list

I can understand that Quarantining an End Point or Attacker is a temporary remediation and that Blacklisting would be the permenant route...however at the same time...I do not understand how that justifies the upgrade deleting this list.

 

Was this a major version jump or a Patch?

 

Re: Quarantine list

Hey there,

 

The quarantine is this way by design. For permanent IP blocking it is recommended to use the firewall feature instead.

 

I believe engineering are working on changing this in the future, but I do not know when this will be.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator