Protection Workspace - Escalated Devices because of Device Control "Info"

[k_holzer]

Hello,

we got some "Escalated" Devices in the Protection Workspace because of our Device Control. We create an Event with severity "Info" for some connected devices. (you can see an example of this in the attached picture). 

Is it possible to exclude this informational events to Tag Devices with the "Escalated" Tag or is this even the expected behavior?

[Hawkmoon]

Hi k_holzer,

The current situation you describe is expected behavior.

That being so you can 'stop' an event (any event regardless of 'severity') from being sent to ePO.

In ePO 'server settings' there is an option called 'event filtering'.
In here you will find a list of all the event types for the product ePO manages listed. You would need to search down the list to find the 'event' you want filter out and simply deselect it.

This will update the agents to not send that event to ePO at all.

Added edit:
DLP events are in the range 19100 - 19171

[k_holzer]

Hi Hawkmoon,

thank you for the response. I don't think that it's a solution for us to stop the Agent from sending the events, because we want them logged.

In this case I think we cannot use the "Escalated" Tag usefully in our environment. 

[robertnixon]

We have the same issue. Sometimes we just wanted the event logged. It is not always a "threat" but could be context to one. Option for rules should be block, notify, log only. Log only would not count towards the 5 threat events that have to happen in 24 hours to add the Escalated tag.

[cdinet]

That would definitely qualify for a new feature request (kb60021), as it would be good to have more control over the escalated status as desired in an environment.