3 Replies Latest reply on Jun 25, 2010 11:11 AM by patty.d00

    Created exception in HIPS and it is not working

    patty.d00

      Created an exception in HIPS IPS rules to allow a .chm file to open.  I currently have 14 exceptions for this signature (2662) and all the other exceptions are working fine.  Initially this particular exception was working fine.  I have recreated it several times and had another person go in and try to fix this and we just can't get it to work.  Running HIPS 7.0.0 1102  sig. 3248

        • 1. Re: Created exception in HIPS and it is not working
          Kary Tankink

          Please review the signature violation for the .chm file.  When you create the signature exception, make sure you're not putting in informaion that is too specific (if you want a signature that cover a broad range of violations for this file type).  If you create the exception directly from the signature violation event, in the ePO console, then the exception will be specfic to that event.  Modify your exception and start with the basic details (Signature name/number, User, Processes).  If the "User" info is specific users, you can set the User entry to "All Users", if you want.

           

          If you put any entries into the "Advanced Details" section, then you will narrow down the exception to only those particular details. If you add a "File" parameter to a particular .chm file, that exception will only apply to that one file.  You can try using wildcards too.  Also, if you add multiple parameters then the ADD or OR operations apply.  If you add multiple entries of the same parameter type, they perform an "OR" operation.  If you add different parameter types, then they are "AND" together.

           

          FILE = xxxxxxxx

          or
          FILE = xxxxxxxx

          and

          SOURCE = xxxxxxxx

          1 of 1 people found this helpful
          • 2. Re: Created exception in HIPS and it is not working
            patty.d00

            Thanks for you help Kary.  I did do all the things you mention and still could not get this to work.  I was fianlly able to get it to work by going into the signature and reducing the severity to low, and the file opened.  Went back in and changed it to medium and it now is working properly.  I have no idea what happened but it is fixed now.  Thank goodness it was driving me nuts!  

            • 3. Re: Created exception in HIPS and it is not working
              patty.d00

              Reduced severity to low and save then go back in and change back to medium.