Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

CSA Virus:Behavior.Excessive Policy Violations

Hi,

I have noticed a number of these surfacing in the quarantined applications.

Is there a way to tune this to prevent this from reocurring across all of the desktops.

As far as I can tell these events are not been recieved by the CSA server. i.e. Loging must be disabled for this event.

1 ACCEPTED SOLUTION

Accepted Solutions

Re: CSA Virus:Behavior.Excessive Policy Violations

You need to find more information about why they are getting there, from the logs you should be getting some idea.

You can create a new group with no rules, and just enable the log override for Log Set Actions, and then apply this group to just one host where you are having the problem, this will give you all the logs that do things like add an application to an application class, like untrusted or active network applications and so on, this would probably give you an idea what is going on.

Few things to consider :

- Are they being marked as untrusted before all this multiple policy viol. happens ?

- Are they being installed by an install manager that hasn't been defined correctly in csa ?

- Is there an inventory tool scanning your pc's that hasn't been defined ?

3 REPLIES

Re: CSA Virus:Behavior.Excessive Policy Violations

You need to find more information about why they are getting there, from the logs you should be getting some idea.

You can create a new group with no rules, and just enable the log override for Log Set Actions, and then apply this group to just one host where you are having the problem, this will give you all the logs that do things like add an application to an application class, like untrusted or active network applications and so on, this would probably give you an idea what is going on.

Few things to consider :

- Are they being marked as untrusted before all this multiple policy viol. happens ?

- Are they being installed by an install manager that hasn't been defined correctly in csa ?

- Is there an inventory tool scanning your pc's that hasn't been defined ?

Re: CSA Virus:Behavior.Excessive Policy Violations

BTW, untrusted applications can be found by doing a host diagnostics from the hosts page in csamc, or looking in the local machines registry in HKLM\SYSTEM\CurrentControlSet\Services\csacenter\Persistent\@DownloadedDB

New Member

Re: CSA Virus:Behavior.Excessive Policy Violations

Many thanks for your help, this work around allowed me to work out what was going on here.

427
Views
0
Helpful
3
Replies
CreatePlease to create content