Loading...

Knowledge Center

'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)
Technical Articles ID:   KB87977
Last Modified:  7/19/2018

Environment

McAfee Endpoint Security (ENS) Threat Intelligence 10.2.x, 10.1.x
McAfee ENS Threat Prevention 10.2.x, 10.1.x

Problem

Action Taken incorrectly reports Threat Intelligence Blocked when Would and Allow ENS Threat Prevention events occur.

Example:
Rule 153 results in event 35102; an Observe mode 'Would Allow' event is reported as Action Taken 'Blocked'.

Cause

ENS Threat Prevention event flow and categorization does not properly report these events.

Solution

This issue is resolved in ENS Threat Intelligence 10.2.2.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.