'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Technical Articles ID: KB87977
Last Modified: 5/11/2020

Environment

McAfee Endpoint Security (ENS) Threat Intelligence 10.2.x, 10.1.x
McAfee ENS Threat Prevention 10.2.x, 10.1.x

Problem

Action Taken incorrectly reports Threat Intelligence Blocked when Would and Allow ENS Threat Prevention events occur.

Example:
Rule 153 results in event 35102; an Observe mode 'Would Allow' event is reported as Action Taken 'Blocked'.

Cause

ENS Threat Prevention event flow and categorization does not properly report these events.

Solution

This issue is resolved in ENS Threat Intelligence 10.2.2.

McAfee Enterprise product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Affected Products

Endpoint Security Threat Intelligence
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

'Action Taken' incorrectly reports 'Threat Intelligence Blocked' (when 'Would' and 'Allow' Endpoint Security Threat Prevention events occur)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title