Hi @ all,
I need to provide exceptions in the threat prevention of ENS10.5.4 managed by ePO 5.9.1 but the added item in the exploit-protection policy does not take effect.
In my case I need an exception for exploit-protection ID 413 "Suspicious Double File Extension Execution". As soon as I disable this option, I can execute my test file with multiple points in the filename.
In our "My Default" policy of "Endpoint Security Threat Prevention" I configured in the area "Exceptions" the test exception as follow:
Name: EXPLORER:EXE - as like as the name is written in the log files of the client
Filename: test.tmp.cmd - also as written in the log file
After saving an pushing this policy to my test client I test it - but it does not work. Why? Any ideas?
Furthermore - is it possible to configure a network path as exception? For example \\domain\netlog?
Best regards,
Sascha
Hi sasu
Here it will be better if you could please open a case with support, we need to take a look at one of the affected systems with a debugged MER (KB82170) and see why the policy enforcement is not working
Hi Aguevara,
thanks a lot for your help!
I opened a ticket. During I was waiting for a response from the support the server executes the policies – so I closed the ticket. A little bit strange.
Do you know if there is a bug with “force policy” in the agent event monitor or by pushing the policies by “agent reactivation” with “force policies” from ePO 5.9.1?
It seems to be a question of time. If I have to wait for any automatically processes.
Regards,
Sascha
What was your case number? I can take a look.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA