Rule group import fails if rules contain SHA-256 installers that aren't added to the Installer tab before import
Last Modified: 2023-12-12 11:33:48 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
After December 1, 2024, please log in to the Thrive Portal for support, knowledge articles, tools, and downloads. For information about using the Thrive Portal, view the Trellix Thrive Portal User Guide.
Rule group import fails if rules contain SHA-256 installers that aren't added to the Installer tab before import
Technical Articles ID:
KB90646
Last Modified: 2023-12-12 11:33:48 Etc/GMT Environment
Application and Change Control (ACC) 8.x
Problem
Rule groups can't be imported if any rule contains an SHA-256 installer and the installer isn't added to the Installers tab before you import the group. NOTE: This issue occurs for both the SHA-256 and SHA-1 versions of the installer when in the same rule group because there's a different entry for each hash. Cause
There currently is a unique constraint for the field SHA-1. The entries for installers by SHA-256 are added individually with the SHA-1 field empty when the policy is imported. The database has a unique constraint for this field on SQL, which is why the error occurs. When you add an installer to a rule, it's added as one entry for each hash. If it's an SHA-256 installer and you add it to a rule, an entry for the SHA-256 is created. If the installer is both SHA-1 and SHA-256, two entries are created, one for each. Solution
You can take one of the following actions:
NOTE: The SHA-256 installers must be added with both SHA-1 and SHA-256 hashes even though the extension allows you to add an installer with SHA-1 only. Affected ProductsLanguages:This article is available in the following languages: |
|