Make policy to exclude process from triggering by ENS in ePO

[Former Member]

Hi.

I have event that triggered by ENS ATP:

I know that I can exclude it by path and md5 hash. But how to do it based on best practice via deploying policy to ENS by ePO?

[tao]

Consider reviewing McAfee Endpoint Security 10.6.0 - Adaptive Threat Protection Product Guide - It does list several ATP best practices:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27592/en_US/...

[akatt · Accepted solution]

@Former Member 

The ATP rule being triggered is rule ID 255, which is rule 19 in the execution order.  This is being flagged as part of Real-Protection Static content analysis.  This cannot be excluded by MD5 hash, but there are a couple of options:

1.  ATP will honor the file/folder exclusions entered within the ENS On-Access Scan policy, under the Standard tab.  For example, if we want ATP to never monitor process execution of DropBox.exe, then we can add DropBox.exe as a file exclusion within this ENS policy.  ATP will only honor the Standard exclusions, and not what is entered within the Low or High-risk settings.

2.  Within ePO's Menu, select Server Settings, and then click on Adaptive Threat Protection.  Here, you can view all of the static rules used for behavioral analysis, in this case rule ID 255.  These rules can be edited, and enabled/disabled as needed.  Since the rule being violated is always set to "Observe," it will not block even when disabling Observe mode within the ATP policies.

If the environment wishes to not see these specific violations, and doesn't want ATP to report (observe) on this specific rule analysis, it can disabled the rule.  However, this will disable the rule entirely.  What might be more beneficial from a security perspective, is to just exclude the file which is executing the process that is violating the rule, provided that the process is trusted.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?