ATP Threat Detection User Messaging concerns

[MLacroix]

Hi,

We want to activate the advance feature of Displaying a threat notification to users when using ATP. While reading documention on this, we noticed that Users can ALLOW any action that they are prompted with in regards to what triggers the notification. As an example, we would set the Rule Assignment to Balanced and the Triger for DAC is Might be Malicious. We want the user to be notified that there could potentialy be a malicious software that is trying to run on their PC.

Unfortunately, they would have the option to ALLOW the software to run uncontained even though we want the software to run in DAC.

Is there a way just to notify the user of an ATP event without letting him decide what to do with the possible malicious event? We want the user to be aware of the situation, but not able to overide McAfee functionnality.

Thanks

M. Lacroix

[Former Member · Accepted solution]

The only options you have for ATP user messages are found within the ENSATP Options policy.

Here you select to display the message, what message is displayed and the default action of allow or block. As far as I am aware, there is no option to just merely display the message without any actions.