Submitted sample reported as allowlisted, but the Global allow list search doesn't list any matching item
Last Modified: 2022-09-30 05:35:11 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Submitted sample reported as allowlisted, but the Global allow list search doesn't list any matching item
Technical Articles ID:
KB87512
Last Modified: 2022-09-30 05:35:11 Etc/GMT EnvironmentAdvanced Threat Defense (ATD)
Intelligent Sandbox (IS) ProblemIn Analysis Results, ATD/IS reports your submitted sample as allow list in the Analyzer Profile and VM Profile columns. But when you search for the sample in Global allow list, you see no matching item listed.
A scan report for your sample is unavailable in the Analysis Results page. The menu items for reports are grayed-out and you can't view or check the reasons for the allow-list action.
CauseATD/IS has a built-in database for trusted digital signatures.
A submitted sample is a PE executable file with a digital signature and the bundled digital signature matches with one of the built-in trusted digital signatures. ATD/IS reports the sample as NOTE: The manager doesn't provide search capabilities for the built-in trusted digital signature database.
SolutionIf you have a sample that returns a scan result as allow listed and you can't find it in the Global allow list search screen, the sample is the likely cause.
You can request a test of the sample to confirm that it has a digital signature that matches one of the built-in trusted digital signatures. Contact Technical Support and include this article number in your Service Request. To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
Affected ProductsLanguages:This article is available in the following languages: |
|