cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
605
Views
0
Helpful
3
Replies

CSA MC 5.2 Rule Exceptions

JayB1rd76
Level 1
Level 1

Having a problem with rule exceptions created through the wizard. We have created several exceptions in a Webserver - Microsoft IIS rule module to allow certain processes. The rules show as enabled but CSA continues to deny the process and log/send out alerts. Any ideas why this would happen? There are several rule exceptions created and none of them seem to work.

Thank you,

Jason

3 Replies 3

jan.nielsen
Level 7
Level 7

Make sure you do a reset locally on the csa gui, just to be sure. If that doesn't help, you probably didn't get the rule created properly. Can you post the event you still get and the contents of the exception you feel should be catching this ?

I'm assuming this is the correct way to do this?

Yes, or if you don't have access to the machine it can be done from the host details in the csamc

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: