MVISION EDR problemas conhecidos

Reference Number	Related Article	Found in MV-EDR version	Resolved in MV-EDR version	Issue Description
SEC-36074	-			Issue: Vulnerability Actions is not shown in actions. Pending SEC-50492.
SEC-46898	-			Issue: The MVISION EPO/EDR client fails to upload a snapshot.
SEC-50492	-			Issue: SIEM Action options are not available on the EDR dropdown for Device Actions in the EDR UI.
SEC-49207	-			Issue: Historical search fails with AR-1104 intermittently through the UI during a programmatic or script performance test.
SEC-49599	-			Issue: When AC is timing out responding to the query, the UI displays an error message: Oops, something went wrong. This error message will be updated in the upcoming releases.
SEC-46277	-			Issue: Auto Suggestion operator does not work for compound query with CommandLine.
SEC-49287	-			Issue: When you apply filters to do the analysis and later clear them, the results get refreshed through an API call.
SEC-48803	-			Issue: The user does one of the following: Goes to the EDR monitoring page and selects PE threat. Clicks the Exclude from threat option from the dropdown in Summary page before process the activity screen loads. In the above scenarios, the Filepath and the CommandLine fields in the Monitoring Exclude threat sections are not populated and are empty.
SEC-46777	-			Issue: Granular Exclusion: Exclusion with escape/special characters should be cleaned up before match.
SEC-45793	-		-	Issue: In the Historical Search dashboard, when you type a commandLine query, suggestions do not appear.
SEC-43301	-	3.2.0	-	Issue: When you use the MVISION EDR API, you see that the API events are exceeding the defined event limits. Although the Case Management runbook supplied with the APIs mentions limits, it does not clearly state how to set limits in actual numbers. The API for rate limiting is: /case-mgmt/v1/rate-limits (GET, PUT) Rate limits can be applied to these actions: new-case new-evidence new-evidence-to-case The default rate-limits are: rate-limits {// Rate Limits default values. // Use API to change rate limits. // new case by tenant new-case = [ { max = 10 duration = "1 hour"} { max = 20 duration = "1 day"} ] // new evidence by case by tenant new-evidence-to-case = [{max = 10 duration = "1 hour"} ] // new evidence by tenant new-evidence = [{max = 10 duration = "1 hour"} ] }
SEC-41123	-	2.4.0.723	-	Issue: Scheduled Reboot Reaction might not work on some Linux platforms (RHEL and SUSE) even though success is returned in Action History. Cause: The Scheduled Reboot Reaction uses the Linux "at" scheduling service to schedule the reboot. This service might not run by default on all Linux platforms. Workaround: Install the "at" service and ensure that the atd daemon is running on the client before requesting a scheduled reboot.
SEC-37830	-	3.3.0		Issue: Action History shows as 'Completed' with error message after action "Scheduled Reboot".
SEC-42307	-	3.4.0		Issue: BigSur operating system is not listing on EDR UI.
SEC-38300	-	-	-	Issue: Two or more open tabs while using MVISION EDR, might cause a user to be logged out due to inactivity. The same applies for any other tab that uses products that rely on the same identity service. For example, MVISION ePO and MVISION Cloud. Cause: MVISION EDR checks for activity independently in each tab. After 20 minutes of inactivity, MVISION EDR invalidates the token, which logs off the user. Workaround: Minimizing the number, or closing any open tabs that remain inactive for longer than 20 minutes, reduces the probability of a logoff occurrence.
SEC-28420		EKS+1	EKS+2	Issue: When you run Historical search queries that contain more than 3 days of information and use include/exclude filters, you see the error: Something went wrong. Solution: Narrow your query. Include less than 3 days of information or remove the include/exclude filters.
SEC-35451				Issue: No event type is displayed for a process activity in the table view of the Process Activity section from the Monitoring Dashboard. Cause: For some specific process activity that occurs close in time to the start of the process, the result can be that this activity has a time stamp earlier than the process that originated the activity. The UI relates that process with the same time stamp than the process created time displaying two events in the same row. Workaround: Click the activity and view the different events that are related to that row in the table. Then, you can see the details of both events.
SEC-35418				Issue: There is a delay in the visibility of events that are generated in the endpoint through the Historical search for just one endpoint. Cause: MVISION EDR time filters use the time specified in the Endpoint which is the time when the activity occurred. But, an endpoint could have a wrong time configuration that is ahead of the current time or is behind it. If it is ahead, filters such as for the last 4 hours do not show that activity until the current time is reached. Solution: Correct the time configured in the endpoint.
SEC-35413				Issue: Filtering by "Observed Techniques" / "Suspicious Indicators" in the Monitoring dashboard does not show the corresponding activity that originated it. This situation occurs when there is no UI visibility of an event in the Process Activity. Instead you see: No Result. Change the filtering criteria Cause: EDR has increased the number of events that are displayed in the Process activity section. But some of them can still be missing. It does not relate the suspicious activity to an activity in the chart or tables because content evolves with higher cadence than UI. Solution: Make sure that there are no filters applied to the graph. If the event is still not displayed, analysis must investigate all activity to properly identify the trigger of the suspicious indicator.
SEC-35355				Issue: Filtering by "Observed Techniques" or "Suspicious Indicators" in the Monitoring dashboard might not show the corresponding activity that originated it. This situation can occur when you don't load all activity apply filters that were applied in the Process Activity widget. Instead You see: No Result. Change the filtering criteria Cause: To improve the speed to show the Process Activity once a new threat is selected in the monitoring dashboard, the UI loads data in two phases. The initial phase partially loads data. It prioritizes process genealogy information. As a result, the activity that originated an observed technique or suspicious indicator might not be loaded. Solution: Click the Show all activity option. All activity loads. Then filter again for the required Observed technique.
SEC-35377 SEC-35378		EDR Client 3.3.0.625		Issue: The CurrentFlow collector that is executed during some searches fails to return any results. Cause: On SUSE Linux Enterprise 15, netstat, from the net-tools package is deprecated. This deprecation might also apply to other Linux distributions that no longer include the net-tools package by default. Solution: Because netstat is still available in the net-tools package (although deprecated), you can get it from the net-tools-deprecated package; SUSEConnect --product sle-module-legacy/15/x86-64
SEC-36169		EDR Client 3.2.0.567 Content Data Update 3.2.0.313	Content Data Update 3.3.0.368	Issue: EDR snapshot tool does not work properly after an EDR content update. You run the snapshot tool, but the tool fails to take a snapshot. You see the following error: Duplicate Core Object ID detected A2857B06-8B01-49C6-8868-E694246413AA Cause: An EDR content update leaves conflicting job definitions. Solution: Remove the EDR Client content package from the Master Repository until an updated content is provided. On affected hosts to be investigated, use the Remove File reaction available in Real-Time Search to remove the conflicting definition found at C:\Program Files\McAfee\MAR\tools\phoenix\vulnerability\files.json.
STLS- 916				Issue: MVISION EDR can't connect to the configured DXL broker. If you look in the DXL brokers IPE log, you see the error: Below minimum threshold. Cause: There are two possible causes: You have incorrectly configured your EDR NTP settings, or Your DXL broker and ePO are not in time sync. For example, they might not be in the same time zone or are more than a minute apart in time. Solution: If the EDR NTP settings are incorrect, correct the server configuration. If the DXL broker and ePO are not in sync, determine the reason and fix it. Make sure that network traffic is not causing a significant lag in communications between them.
SEC-33805				Issue: Duplicate listings of ePO servers are seen in the Configuration Page, under Configure data sources. Cause: Connection issues. Solution: Refresh the UI. You can ignore the issue. This issue is cosmetic and does not affect product function.
SEC-34655				Issue: You take a manual action to quarantine or End-quarantine a device in the Investigation dashboard. But, the state is not updated until it is refreshed. Then, the End-quarantine action does not display after a quarantine action. Cause: Investigation does not refresh options after an action. Solution: Refresh the UI.
SEC-33791				Issue: After you switch between threats in the monitoring screen, process activity displays the message: No results. Change the filter criteria. It then loads the correct process activity. Cause: Engineering updated the widget to load faster and in phases, causing this issue. Solution: Wait until the process activity fully loads.
SEC-31708		3.2.0.567		Issue: Investigations via phishing email do not display or add artifacts. (U.S. ONLY)
SEC-31410		3.2.0.567	3.2.0.571	Issue: The EDR client process (mfemvedr.exe) uses a large amount of memory and the system does not respond after a content data update. Workaround: Disable the Unattended Content Updates on the EDR Policy, General tab.
SEC-28325		3.0.0.404	3.2.0.567	Issue: Can't end Quarantine in an endpoint that is using a VPN Solution: Upgrade to 3.2.0.567 or later as available. Once upgraded, add the VPN agent full path under: EDR Policy, Network Flow, Ignore Application Paths from Quarantine.
SEC-28224		3.1.0.478	3.2.0.567	Issue: You see high CPU use and slowdown on 32-bit Windows clients. Workaround: Disable the Trace for affected endpoints. Or, if experiencing issues with specific processes, exclude them. See the Product Guide for further information about making these changes. Solution: This issue is resolved in 3.2.0.567.
SEC-26610		3.1.0.478		Issue: During the upgrade of EDR Client on Windows 7, a pop-up message displays for a few seconds with the title: A program running on this computer is trying to display a message. This message does not affect the installation. The product successfully installs. Cause: The Windows service Interactive Services Detections is enabled. This service is disabled by default and is available only on Windows 7. Workaround: Temporarily disable the Windows service Interactive Services Detections during the upgrade of EDR Client.
SEC-26516		3.1.0.478	Content Data Update 3.2.0.308	Issue: EDR Content Data Update 3.0 fails to download when EDR Client 3.1 or later is installed. Cause: Content Data Update 3.0 does not recognize version 3.1 or later. Workaround: Check in the latest Content Data Update 3.1 or later to the Master Repository. The update is available from the ePO Software Catalog.
SEC-21695		3.0.0.404	3.1.0.478	Issue: The EDR Trace database grows larger than the maximum size configured in the policy. The database is at: %PROGRAMDATA%\McAfee\MAR\data\trace.db
MACC-8711	KB92292		MACC extensions 8.2.6 and 8.3.	Issue: The EDR Real Time Search feature is prevented from running scripts when MACC is enabled. Cause: McAfee Execution Control in MACC 8.x added default Execution Control Rules and McAfee rule groups. These rule groups need to be updated to allow the newer version to run. Workaround: See the related article. Solution: This issue is fixed with the release of MACC extensions 8.2.6 and 8.3.
SEC-18920			ENS Exploit Prevention content released March 2020, or later, fixes this issue.	Issue: An EDR Reaction fails to execute in the endpoint. Cause: An option in ENS prevents EDR from running some Real Time Search Reactions. Workaround: Add an exclusion to the EDR service in the ENS Exploit Prevention policy: In ePO, go to Policy Catalog. Select the product Endpoint Security Threat Prevention and then the feature Exploit Prevention. Open the policy that you are using. In the Advanced view, open Exclusions and add an exclusion. Fill the fields with this info: Exclusion Type: Illegal API Use - Buffer Overflow Caller Module - Name: MFEMVEDR.EXE Caller Module - Enable digital signature check - Signed by: C=US, S=CALIFORNIA, L=SANTA CLARA, O="MCAFEE, INC.", OU=ENGINEERING, CN="MCAFEE, INC." Apply this policy to the endpoints.
SEC-18379		3.0.0.355	3.1.0.478	Issue: On Windows 10 build 1607 (RS1), applications such as Microsoft Office, Adobe Acrobat Reader, and Chrome, fail to start. Workaround 1: Install all Windows updates for build 1607 (RS1). Workaround 2: Open the MVISION EDR Policy. Click the Trace tab. Deselect the Injection Detection option. Apply the configuration: Disable the Trace plug-in and then enable it. Or, restart the endpoint. NOTE: By disabling this option, the EDR client does not detect when a process injects another process.
SEC-18283		3.0.0.355		Issue: Installation of some applications that perform intensive file moves, removals, or changes, displays errors and fails to complete. Cause: The EDR client locks these files during the installation. Workaround 1: Disable the Trace plug-in during the installation. Workaround 2: Add the installer or process that runs it to the ignored files into the Trace Policy.
SEC-16670		3.0.0.355	3.2.0.567	Issue: When you quarantine an endpoint connected to a VPN, the endpoint becomes unreachable. You can't send the reaction to End the Quarantine. Workaround: Gain physical access to the endpoint. Uninstall the EDR Client from Add and Remove Programs. Reinstall the EDR client.
SEC-18244		3.0.0.404	3.0.0.432	Issue: The network verbosity feature is enabled by default. The results are unnecessary collection in the endpoints and unnecessary traffic in the customer network. Workaround: For on-premises ePO, open all active EDR policies in ePO and save each one without making any changes. This action disables the verbosity configuration. For MVISION ePO environments, clone My Default policy, edit, save without any changes, and then assign it to all your endpoints.
SEC-13542		3.0.0.355	3.0.0.404	Issue: On Windows Redstone 5 and later, Internet Explorer or Edge might lose internet connection when using a proxy configuration file. But, other browsers like Chrome or Firefox continue working properly. Workaround: Manually enter your proxy settings in Internet Explorer or Edge.
SEC-17368			3.0.0.432	Issue: The EDR service does not start if MVISION EDR is installed on an endpoint with ENSM installed. Workaround: Technical Support has a script to fix the issue. Contact support to obtain this script.
SEC-17451			Fixed by upgrading to MA 5.6.3	Issue: Proxy autoconfiguration script files, such as proxy.pac, are hosted on a web server. If needed, they can be stored locally and accessed. Prefix their location with file:// in the Internet Explorer LAN settings. In this situation, Internet Explorer can still use the proxy.pac file, but MA (assuming its proxy settings are configured to Use IE Settings) is unable to do so. MA reports no usable proxy found in the mcscript.log. Workaround: Reboot the endpoint.
SEC-16939				Issue: In MVISION ePO, Mac and Linux EDR clients are not yet supported. Solution: Not available. For environment information, see KB91345 - Supported platforms for MVISION EDR.
SEC-16930			3.1.0.478	Issue: The MVISION EDR client service stops working if you install or upgrade the MVISION Endpoint client after it was installed on a Windows system. Solution: Restart the service by restarting the operating system.
SEC-14475			3.0.0.404	Issue: During EDR Client installation, Visual C++ Redistributable Package removes binaries for non-target architectures. Specifically, MSVCR120.dll is deleted. This issue is a Microsoft runtime issue in Visual C++ Redistributable Package. Solution: Apply the updated distributable available at: https://support.microsoft.com/en-us/help/3138367/update-for-visual-c-2013-and-visual-c-redistributable-package
SEC-14375				Issue: Can't install MVISION EDR client with ENS 10.6.2/6.3 in Linux because of failed dependencies: You see the error: ISecGRt >= 10.0 is needed by MVEDR Agent Solution: Upgrade to ENS 10.6.4 or later.
SEC-13802			3.0.0.404	Issue: The Monitoring or Historical Search dashboards might display incorrect information about the device. Incorrect information includes such as operating system version, MAC address, or ePO tags.
SEC-12291				Issue: The Include and Exclude filters in the Historical Search Dashboard, do not filter the Alerts and Detections & Alerts buckets.
SEC-12553				Issue: Hierarchy in the process tree from the Process Activity widget breaks. Cause: The parent process is not present. As a result, the sequential and timeline view in Process Activity, does not show the process tree correctly. Workaround: Select another detection instance for the same threat from the Device section in the Monitoring dashboard.
SEC-10757				Issue: When you disable telemetry feedback options, the feedback option requires that you accept the sharing of telemetry data. If you do not accept it, the send button on the feedback section is not enabled. Solution: Enable telemetry settings: Open the Investigation Dashboard, and from the settings wheel, navigate to the Configuration settings. Enable Choose telemetry and regional settings. Read the agreement and click Save.
SEC-9932				Issue: Duplicated alerts are seen. When a Process Injection is detected as a threat in the Monitoring dashboard, the Injector process and the Injected process are shown as potential threats. So, they can be perceived as duplicated threats.
SEC-9777			Client 3.0.0.175	Issue: [Agent] When you disable or enable the trace plug-in, the traces are not sent to the cloud until you reboot the endpoint. Solution: If you enable the trace plug-in on an endpoint through the MVISION EDR endpoint policy after it was previously disabled, you must reboot the endpoint to have trace data sent again. Endpoint activity is not monitored until the reboot is completed.
SEC-9719			MVISION EDR extension version 3.0.0.758	Issue: Unable to open MVISION homepage from on-prem ePO. The MVISION EDR homepage link from the McAfee ePO menu does not work. Solution: To access the MVISION EDR page, go to the URL https://ui.soc.mcafee.com. Solution: Fixed in MVISION EDR Client version 3.0.0.175.
SEC-9706				Issue: After installation, the EDR extension server settings display a Host Timeout Error. SIEM connection on the MVISION EDR settings available in Server settings on McAfee ePO show connection as: The indicated Host responded TIMEOUT. This information is displayed even though no configuration has been performed. Solution: When the SIEM is configured correctly, this setting changes to Connection Successful as expected.
SEC-7057				Issue: Device Name is not displayed under Affected Devices, Threat Details session in Monitoring workspace. Solution: Follow the deployment steps as documented in the Installation Guide or UI wizard. If the MVISION EDR client is deployed in the endpoints before it completes the extension installation flow, some device information might not be displayed. Information such as host name or IP address, might not be displayed in the Device panel of the Monitoring dashboard. To fix the problem, reboot the unlisted device.

Knowledge Center

MVISION EDR Known Issues

Ambiente

Resumo

Informações relacionadas

Produtos afetados

Idiomas:

Glossário de termos técnicos

Title

Title

Knowledge Center

MVISION EDR Known Issues

Ambiente

Resumo

Informações relacionadas

Produtos afetados

Idiomas:

Glossário de termos técnicos

Escolha a sua região

Title

Title