Screencasts - Hilfsvideos

Increase in ws.reputation.1 risks since deploying 12.1.4

Created: 02 Apr. 2014 • Aktualisiert: 08 Apr. 2014 | 9 Kommentare
Dieses Problem wurde gelöst. Siehe Lösung.

We recently upgraded our SEPMs to 12.1.4 (Windows 2003 r2 x86 servers)  Last Thursday I began deploying install packages to a subset of our environment and since we have seen an increase in reputation violations.  At first I thought it was just the Prism application, that something had changed in the program that caused it to become an unknown.  However I have been seeing others.  Was wondering if anyone else has seen this behavior in 12.1.4.  Does it use the same reputation database as 11.0.6?

Operating Systems:

Kommentare KommentareZum neuesten Kommentar

das Bild der Brɨans

It's from download insight. Have you added exceptions?

Managing Download Insight detections

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der Ariphaneuss

Yeah.  Having the team submit for whitelisting.  Just seemed coincidental that right as we started the deployment there was a sudden jump in the reputation violations.  don't remember seeming many when we were still on 11.0.6 so just want to confirm that it had nothing to do with version.

das Bild der Brɨans

That's because 11.x didn't use Insight :)

It's a new feature in 12.1

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

LÖSUNG
das Bild der Ariphaneuss

Is insight a new reputation engine in 12.x?  I thought reputation has been in general use since 2010?

das Bild der Brɨans

Yes, it is new to 12.1

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

das Bild der Ariphaneuss

Is there a way of disabling Download Insight on all but a few machines for testing?

das Bild der Brɨans

Sure. Just create a test group, break inheritance on it and move those machines to it. Assign a policy which has Insight enabled.

For your main policy, just go in to your AV policy, Download Protection tab and uncheck "Enable Download Insight" to disable

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

LÖSUNG
das Bild der Brɨans

Happy to help :)

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.