Hello, everybody.

I created a blacklist and added an IP address. When I try to access this IP through RDP or SMB, the AMP sometimes block the connection and other times doesn't, just showing a warning. When I look at the events, I see the message: "Host detected mstsc.exe as DFC.CustomIPList.MalParent but was not quarantined because it is a signed". Is this behavior expected?

Screens attached.

Thanks for now.