Endpoint Security 10.7.0 extension changes Medium severity Exploit Prevention signatures to enable Block and Report in the default policy

Technical Articles ID: KB92310
Last Modified: 2023-02-07 16:43:03 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.7.0

Problem

After you install or upgrade to the ENS Threat Prevention 10.7.0 extension, all Medium severity Exploit Prevention signatures will change to enable the Block and Report setting within the default policy. This is a change from earlier ENS versions where Medium severity signatures have Block and Report disabled by default. This can possibly generate false positives in your environment, depending on the signature and coverage details.

Solution

This issue is resolved in ENS 10.7.0 February 2020 Update.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround 1

Modify the ENS Threat Prevention Exploit Prevention policy assigned to the systems and disable the Block and Report setting for Medium severity signatures.

Workaround 2

Review the ENS Threat Prevention Exploit Prevention Medium severity events and determine whether a false positive event occurred. If the signature is not applicable to the environment, disable the signature.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Endpoint Security 10.7.0 extension changes Medium severity Exploit Prevention signatures to enable Block and Report in the default policy

Environment

Problem

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security 10.7.0 extension changes Medium severity Exploit Prevention signatures to enable Block and Report in the default policy

Environment

Problem

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Choose your region

Title

Title