Multiple alerts for the automatic response "Bad Binary has been detected in Enterprise" after upgrade to Application and Change Control Extension 7.0.x

Technical Articles ID: KB86184
Last Modified: 7/29/2020

McAfee Application and Change Control (MACC) 7.0.x

After an upgrade to MACC Extension 7.0.x, there is an issue with the automatic response Bad Binary has been detected in Enterprise:

If the extension was upgraded with the automatic response Bad Binary has been detected in Enterprise disabled, Trigger this response if multiple events occur within shows 1 Hour instead of 10 minutes.
If the extension was upgraded with the automatic response Bad Binary has been detected in Enterprise enabled:
- The older alert is not changed. A new alert is created.
- The name of the new alert is SolidcoreEmailNotificationForBadFile.name.

Multiple alerts occur because all files signed by a malicious certificate are also tagged as malicious.

To avoid getting multiple alerts:

Log on to the ePO console.
Navigate to Menu, Automation, Automatic Responses.
Disable the automatic response Bad Binary has been detected in Enterprise.
Enable the automatic response Bad Binary has been detected in Enterprise (7.0).

Application and Change Control 7.0.x (EOL)
Known Issue/Product Defect

This article is available in the following languages:

Knowledge Center