Endpoint Protection

 View Only

  • 1.  Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 07:52 AM
      |   view attached

    Symantec provide a solution on this issue if you experience this on your SEPM Manager and endpoints.

    https://support.symantec.com/en_US/article.TECH217755.html

    This is due to depreciated IPS Signatures.

     

    The solution is to remove the depreciated IPS Signatures and this is a tedious job for customers as it involves over 2252 IPS Signatures.

    What I can not understand is why does Symantec not clean up the IPS Signatures and remove these? So then the customers can just readd the signatures again to the IPS Policy and the depreciated IPS Signatures are no longer available to add, therefore no errors? 

     

    I do not know if the Symantec Community out there agree?

     

    Attachment(s)

    docx
    IPS Signatures.docx   61 KB 1 version


  • 2.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 07:54 AM

    It's been a known thing for some time now...would be nice to see it cleaned automatically but hasn't happened yet so what can you do.

    Was a thread about it here:

    https://www-secure.symantec.com/connect/forums/client-log-show-ips-signature-failed



  • 3.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 07:57 AM

    It creates a negative perception with customers as when things go wrong on a server or endpoint , they see these errors and you have to tell them IPS has nothing to do with the problem and to ignore the errors. I created a poll on this and would like community to vote to get this cleaned up...



  • 4.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 07:59 AM

    Poll can be found here, please vote:

    https://www-secure.symantec.com/connect/polls/symantec-clean-there-ips-signatures-depreciated-signatures

     



  • 5.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 08:02 AM

    I would also suggest creating an idea in the Idea section. I know those get reviewed quite often and some times implemented.



  • 6.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1
    Best Answer

    Posted Jul 09, 2015 09:22 AM

    Thanks Brian, have posted the idea too, PLEASE VOTE THERE TOO :

    https://www-secure.symantec.com/connect/ideas/symantec-clean-their-sep-ips-signatures

     



  • 7.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 09, 2015 09:24 AM

    Getting 'Access Denied'.....
     



  • 8.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 10, 2015 04:29 AM

    Should work, let me know Brian, thanks for your help



  • 9.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Jul 10, 2015 03:03 PM

    Many thanks for the feedback, LeighT and other contributors.  please do not let these error messages put oyu off IPS- it is absolutely essential in my opnion.



  • 10.  RE: Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1

    Posted Aug 02, 2015 11:32 PM

    Strongly agree with with LeighT, Brian and Mick2009 author of: Two Reasons why IPS is a "Must Have" for your Network and the famous quote "but trying to defend your data with AV alone is definitely fighting with one arm tied behind your back." Having to explain to management Warning: failed to set a custom action for IPS signature in Endpoint Protection 12.1 (Article: TECH217755) is not the same as seeing the errors over and over in the logs as LeighT explicates for any incident ...i.e. "negative perception with customers as when things go wrong on a server or endpoint."