cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Jmac24
Level 12
Report Inappropriate Content
Message 1 of 22

Protection Workspace Automatic Responses

Having some sluggishness in ePO and I see that we have anywhere between 350,000 and 400,000 automatic responses for a default Protection Workspace event called "Protection Workspace - Master Threat Summary Rule" which in it actions just runs "Protection Workspace - Master Threat Summary Action".

It is completely taking over our server task log as it triggers for every event, thus the large number as mentioned above. I am wondering if anyone has some insight into exactly what this does and if the response can (or should) be throttled to only run every so often. 

21 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 22

Re: Protection Workspace Automatic Responses

Yes, it can be throttled or disabled as desired.  Throttling it to 15 minutes might give you some relief for it.  They are working on fixing this, but it might not be till after November.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Jmac24
Level 12
Report Inappropriate Content
Message 3 of 22

Re: Protection Workspace Automatic Responses

Do you know the ramifications of disabling it? I tried finding exactly what the response actually does, but no luck. If I knew what it was doing I could decide how to best modify it for our implementation. Thanks for your reply, I'm glad it's being worked on.

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 22

Re: Protection Workspace Automatic Responses

I would probably throttle it vs disabled it, as it gathers the summary data for the protection workspace dashboard. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

mastercam
Level 9
Report Inappropriate Content
Message 5 of 22

Re: Protection Workspace Automatic Responses

Hi - Where is the setting changed? 

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 22

Re: Protection Workspace Automatic Responses

That is in the automatic response settings.  What build extension are you running for protection workspace?  Go to software manager/catalog in epo and download the latest protection workspace 1.0.0.1302 - it is posted to software manager. Its part of the "Mvision Endpoint ePO extensions" bundle. Just download that bundle, then extract it and check in the latest protection workspace extension only.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Protection Workspace Automatic Responses

Hi, i am facing the same issue. I have 13000 protection workspace tasks in server task log stuck in 'In Progress' state. I don't see the newer extension in my software catalog, is there a newer version available for ePO 5.9.1?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 22

Re: Protection Workspace Automatic Responses

Did you download the Mvision Endpoint ePO extensions bundle and extract it?  Also, reduce the frequency of the automatic response for that to 15 or 30 minutes.  To clear the stuck in progress status, try stopping epo services, but do not kill the tomcat process because it takes a long time to stop.  Let it stop on its own, no matter how long it takes.  Then start back services and see if they go away.  If you kill the process, they will just re-queue and run again.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Protection Workspace Automatic Responses

Thank you for the response. I downloaded and installed the 1.0.0.975 version of Protection Workspace from my ePO's software manager. I have already setup throttling and reduced the frequency to 1 hour. Will try to restart services and let you know.

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 22

Re: Protection Workspace Automatic Responses

There is a later extension in the bundle that I mentioned - version 1.0.0.1302.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community