'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Technical Articles ID: KB87977
Last Modified: 2020-05-11 16:15:11 Etc/GMT

Environment

McAfee Endpoint Security (ENS) Threat Intelligence 10.2.x, 10.1.x
McAfee ENS Threat Prevention 10.2.x, 10.1.x

Problem

Action Taken incorrectly reports Threat Intelligence Blocked when Would and Allow ENS Threat Prevention events occur.

Example:
Rule 153 results in event 35102; an Observe mode 'Would Allow' event is reported as Action Taken 'Blocked'.

Cause

ENS Threat Prevention event flow and categorization does not properly report these events.

Solution

This issue is resolved in ENS Threat Intelligence 10.2.2.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title