Protection Rule blocks application even if further actions don't violate rule settings
Last Modified: 2023-05-30 02:59:30 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Protection Rule blocks application even if further actions don't violate rule settings
Technical Articles ID:
KB83757
Last Modified: 2023-05-30 02:59:30 Etc/GMT Environment
Data Loss Prevention Endpoint (DLP Endpoint) - all supported versions For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint. ProblemProtection rules are enforced on a client and a block action occurs. The protection rules might be Network Communication, All further actions that use the offending application are blocked. These actions are blocked even if the action doesn't violate the settings of the protection rule. SolutionDLP Endpoint is operating as designed. The protection rule action block acts on the Process ID (PID) of the offending application. It doesn't release it until the process, as defined by its PID in the Task Manager, is stopped and restarted.
Workaround
Restart the application and make sure that the PID changes for this action. Or, end the task on the offending application's PID using Task Manager.
Affected ProductsLanguages:This article is available in the following languages: |
|