Real-time Search requirements

[vtgt]

MVISION EDR Real-time Search does not work in our Windows environment and concludes with error code: 257 - "Collector or reaction couldn't execute content on the endpoint." According to https://kc.mcafee.com/corporate/index?page=content&id=KB92810 the Windows Script Host has do be enabled, but for security reasons this registry key is set to 0 in our environment. Is the Windows Script Host a must criteria for Real-time Search or are there other options available to use this feature? We tried to create an own collector with a signed PowerShell script but this does not seem to work either. The search result here is error code: 262 - "Can't parse collector output." Any recommendations or hints to make MVISION EDR Real-time Search work for us is much appreciated.

[AjaySundar]

Hi @vtgt,

Good day to you!

Could you please confirm if this collector that you are executing is McAfee in-built ones or a customer collector?

>> Is the Windows Script Host a must criteria for Real-time Search or are there other options available to use this feature?

Yes, any script execution done through EDR and MAR requires the "Windows Script Host" to be enabled.

I hope this helps.

Regards,

Ajay

[vtgt]

Hi @AjaySundar 

Thanks a lot for your confirmation!

We are a little bit stuck between a rock and a hard place: for security reasons our Windows Script Host is disabled by GPO. But we want and need to use the real-time search for IOCs.

Do you have an idea for temporarily enabling the Windows Script Host by an ePO action for the usage of real-time search?

The other topic "error code: 262" is related to a custom collector that we created for testing. Here it would be great to see some configuration examples with syntax description in the documentation.

Are there any plans to publish examples for creating custom collectors for specific needs?