Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Increase in ws.reputation.1 risks since deploying 12.1.4

Created: 02 Apr 2014 • Updated: 08 Apr 2014 | 9 comments
This issue has been solved. See solution.

We recently upgraded our SEPMs to 12.1.4 (Windows 2003 r2 x86 servers)  Last Thursday I began deploying install packages to a subset of our environment and since we have seen an increase in reputation violations.  At first I thought it was just the Prism application, that something had changed in the program that caused it to become an unknown.  However I have been seeing others.  Was wondering if anyone else has seen this behavior in 12.1.4.  Does it use the same reputation database as 11.0.6?

Operating Systems:

Comments 9 CommentsJump to latest comment

Brɨan's picture

It's from download insight. Have you added exceptions?

Managing Download Insight detections

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Ariphaneus's picture

Yeah.  Having the team submit for whitelisting.  Just seemed coincidental that right as we started the deployment there was a sudden jump in the reputation violations.  don't remember seeming many when we were still on 11.0.6 so just want to confirm that it had nothing to do with version.

Brɨan's picture

That's because 11.x didn't use Insight :)

It's a new feature in 12.1

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SOLUTION
Ariphaneus's picture

Is insight a new reputation engine in 12.x?  I thought reputation has been in general use since 2010?

Brɨan's picture

Yes, it is new to 12.1

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Ariphaneus's picture

Is there a way of disabling Download Insight on all but a few machines for testing?

Brɨan's picture

Sure. Just create a test group, break inheritance on it and move those machines to it. Assign a policy which has Insight enabled.

For your main policy, just go in to your AV policy, Download Protection tab and uncheck "Enable Download Insight" to disable

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SOLUTION
Brɨan's picture

Happy to help :)

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.