Loading...

Knowledge Center


An ePolicy Orchestrator Restore from quarantine task fails (Threat Intelligence Exchange module file detection name mismatch)
Technical Articles ID:   KB88096
Last Modified:  9/25/2019

Environment

McAfee ePolicy Orchestrator (ePO) 5.x
McAfee Threat Intelligence Exchange Module (TIEm) for VirusScan Enterprise (VSE) 1.0.2, 1.0.1
McAfee VirusScan Enterprise (VSE) 8.x

Problem

An ePO Restore from quarantine task that uses the detection name reported in an ePO threat event (for example, TIESuspect!cbf09) fails.

Locally, the Restore from quarantine task runs, but nothing is restored, and the detection is still listed in the Quarantine screen of the local VirusScan Console.

Cause

The detection name in the ePO threat event does not match the reported detection name in VSE.

Solution

This issue is resolved with TIEm for VSE 1.0.3.121.2.

To view other TIEm for VSE known issues, see KB84487.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Workaround

In ePO, create a Restore from quarantine task with the exact detection name reported on the Quarantine screen of the VirusScan Console.

To learn more about client and server tasks in ePO, see the ePO Product Guide.

For McAfee product documents, go to the Enterprise Product Documentation portal at https://docs.mcafee.com.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.