ENS ATP blocking Cumulus service after 10.7 sep upgrade

[vnaidu]

We have a situation where McAfee ATP is stopping the Cumulus Sequencer Service stopped. We have the ATP policy in Observer mode, as per our understanding when the ATP is in observe mode, it should not ideally create any issues as we have not kept in protected mode.

This issue occurred after we upgrade our ENS 10.6.1 Sept 2019 update to 10.7.0 September 2020 update. We would like to know why ATP is blocking the Cumulus Sequencer Service. The service is going to stopping stage and cannot get it restarted.

I have provided the ATP logs from two different machines for your review. Kindly help us as this is causing a big concern for us.

[Kenchee_etf]

Hello @vnaidu 

Just to cover basics, did you reboot machine after ENS upgrade?

Second question is, did you perform additional troubleshooting and what result did you receive to make you conclude that the issue is caused by ATP, but not, for example, AP or EP?

Last, but not least, maybe I am missing something, but I don't see any logs provided here.

[vnaidu]

@Kenchee_etf 

Refer 4-21401010901

[vnaidu]

@Kenchee_etf

The KB article KB92878 says update to July 2020, but we are already running with ENS 10.7 September Update, so can someone help us what can be done.