This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Authorization of Sus files/behaviour

I am trying to Authorize a file that has been flagged as having Sus/Behaviour.

Gone into the AV/HIPS policy  and Authorization Manager part

There are 2 instances of the file concerned, I don't what to authorize both as 1 is from a desktop and 1 is from a server.

My Question is how do I relate the entry back to the correct machine, I assume its via the Checksum figure but I can't work out where to find the correlation between them

SEC 4.0.0.2362

Thanks

Jon

:3607


This thread was automatically locked due to age.
Parents
  • I don't want to have to remote into a client machine everytime I need to check a file

    Weeeeell, how do you know that the one is acceptable and the other isn't? You'll probably have to access the clients in one way or the other. And what if each file is detected on more than one client? There's no easy way to display this information in a useful manner in SEC.

    IMO opinion the only reasonable place to display checksum/version is in the client's Computer details.

    Christian

    :3637
Reply
  • I don't want to have to remote into a client machine everytime I need to check a file

    Weeeeell, how do you know that the one is acceptable and the other isn't? You'll probably have to access the clients in one way or the other. And what if each file is detected on more than one client? There's no easy way to display this information in a useful manner in SEC.

    IMO opinion the only reasonable place to display checksum/version is in the client's Computer details.

    Christian

    :3637
Children
No Data