On macOS, the reaction StopandRemoveFileSafe, when used with full file path, doesn't kill the process

Technical Articles ID: KB96506
Last Modified: 2023-05-03 09:00:02 Etc/GMT

Environment

Endpoint Detection and Response 4.1.x

Problem

On macOS, when the StopandRemoveFileSafe reaction is executed using the full file path, the file is deleted, and the reaction is marked as 'success' in 'action history.' But, the process continues running.

Solution

Technical support is investigating this issue.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Workaround

To workaround this issue, perform either of the following actions:

Before you execute the action, provide the file checksum, as well as the file path:
Remove the file and then query the process in RTS. Then, Kill the Process by either the PID, Hash, Name, or Path.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

On macOS, the reaction StopandRemoveFileSafe, when used with full file path, doesn't kill the process

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

On macOS, the reaction StopandRemoveFileSafe, when used with full file path, doesn't kill the process

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title