In-Progress "Protection Workspace - Master Threat Summary Rule" (Server Task Log overloaded)

Technical Articles ID: KB91613
Last Modified: 2023-07-28 10:56:00 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.10.x, 5.9.x
Protection Workspace Extension 1.0.0.975 or earlier

Problem

After you check in the MVISION Protection Workspace extension to ePO, you might observe that the Protection Workspace - Master Threat Summary Rule is triggered on every Threat Event.

This flood of events writes an excessive number of entries into the ePO tables within the database.

The Server Task Log records numerous automatic responses:

In-Progress "Protection Workspace - Master Threat Summary Rule"

The issue only occurs when you check in the Protection Workspace extension 1.0.0.975 or earlier.

Solution

With Protection Workspace Extension 1.0.0.975 or earlier, this behavior is expected. But, because of the impact on performance and server resources, an update has been provided.

This issue is now resolved with the Protection Workspace versions below, which are available in the ePO Software Manager.

Protection Workspace User Interface 1.0.0.1875
Protection Workspace Services 1.0.0.1521

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

Increase the trigger response time:

Log on to the ePO console.
Under Automation, select Automatic Response.
In the Action column of Protection Workspace - Master Threat Summary Rule, click Edit.
From the Aggregation tab of the Response Builder dialog box, enable Throttling, and set the Trigger response to every 15 minutes.

NOTE: All events continue to be picked up and processed. But, the only difference you see in the Protection Workspace is that events take up to 15 minutes to be displayed.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

In-Progress "Protection Workspace - Master Threat Summary Rule" (Server Task Log overloaded)

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

In-Progress "Protection Workspace - Master Threat Summary Rule" (Server Task Log overloaded)

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title