Adaptive Threat Protection cache reset at every policy enforcement

Technical Articles ID: KB95290
Last Modified: 2022-07-25 04:40:12 Etc/GMT

Environment

Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x

Problem

When you modify five or more ENS ATP rules, the ATP cache is reset on every policy enforcement. This issue causes higher network traffic to the Global Threat Intelligence (GTI) cloud or Threat Intelligence Exchange (TIE) Server for file reputation requests. On the TIE Server, this issue can also cause a high CPU load.

Steps to verify whether you have this issue:

Log on to the ePolicy Orchestrator (ePO) console.
Go to Server Settings.
Select Adaptive Threat Protection.
Check whether there are more than four rules denoted with an asterisk. For example: observe* or enable*.

NOTE: The asterisk denotes the rules that have been modified from the default.

Cause

A specific ATP rule doesn't cause this issue. The issue occurs due to the number of ATP rules with the status being changed from default. If you change five or more ATP rules from default to observe, enable, or disabled, the ATP cache reset occurs on each policy enforcement. The issue doesn't occur if you set five ATP rules to a mix of observe, enable, or disabled.

Solution

This issue is resolved in the ENS 10.7.0 June 2022 Update.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround 1

Reduce the number of ATP rules modified from default to a maximum of four modified rules with the same state:

Log on to the ePO console.
Go to Server Settings.
Select Adaptive Threat Protection.
Click Edit.
Set the ATP rules back to default, leaving a maximum of four modified rules with the same state.

Workaround 2

Change the ATP Rule Assignment from Balanced to Productivity:

Log on to the ePO console.
Go to Policy Catalog.
Click Endpoint Security Adaptive Threat Protection.
Click Option.
Open your policy.
Change the Rule Assignment from Balanced to Productivity.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Adaptive Threat Protection cache reset at every policy enforcement

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Title

Title

Knowledge Center

Adaptive Threat Protection cache reset at every policy enforcement

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Choose your region

Title

Title