Endpoint Protection

Hello

For Audit and Forensinsing purpose we use Metasploit to perfomr some tasks on a our fleet, but the exploit is blocked By SEP :) (Googd Think) but it's blocking us to performe our "white hacking" Stuff.

I add the server to the Excludes hosts on Intrusion Prevention Policies but its still not working

is there any other steps that should be taken to allowd such operation

Kind regards

N.Achraf

What else is blocking it? It may be the AV portion, not the IPS. If IPS then did you ensure the clients picked up the policy change.

This is going to be a difficult task because SEP is doing its job by blocking it and Metasploit will throw many different attacks at it.

i dont see any log on the target that can help me detemrin which portion block my attacks 

You're checking either Risk log, Security log,Threat log (SONAR) or Traffic (Firewall). If there is nothing there than I can't assume SEP is blocking it.