EDR/Active Response collectors are blocked from running on Linux with Application Control enabled
Last Modified: 2023-06-29 08:55:32 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
After December 1, 2024, please log in to the Thrive Portal for support, knowledge articles, tools, and downloads. For information about using the Thrive Portal, view the Trellix Thrive Portal User Guide.
EDR/Active Response collectors are blocked from running on Linux with Application Control enabled
Technical Articles ID:
KB93628
Last Modified: 2023-06-29 08:55:32 Etc/GMT Environment
Application and Change Control (ACC) 6.4.x Linux/Unix Problem
When ACC is enabled, collectors for Endpoint Detection and Response (EDR) and Active Response are blocked from running on Linux.
Cause
The EDR and Active Response processes aren't added as updaters in the Application Control Rule groups for Linux by default.
Solution
This issue is resolved in ACC Linux 6.4.12-125 and Solidcore extension 8.3.2-114.
Workaround
Configure Configure Affected ProductsLanguages:This article is available in the following languages: |
|