cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
770
Views
0
Helpful
3
Replies

CSA Virus:Behavior.Excessive Policy Violations

ivickery
Level 1
Level 1

Hi,

I have noticed a number of these surfacing in the quarantined applications.

Is there a way to tune this to prevent this from reocurring across all of the desktops.

As far as I can tell these events are not been recieved by the CSA server. i.e. Loging must be disabled for this event.

1 Accepted Solution

Accepted Solutions

jan.nielsen
Level 7
Level 7

You need to find more information about why they are getting there, from the logs you should be getting some idea.

You can create a new group with no rules, and just enable the log override for Log Set Actions, and then apply this group to just one host where you are having the problem, this will give you all the logs that do things like add an application to an application class, like untrusted or active network applications and so on, this would probably give you an idea what is going on.

Few things to consider :

- Are they being marked as untrusted before all this multiple policy viol. happens ?

- Are they being installed by an install manager that hasn't been defined correctly in csa ?

- Is there an inventory tool scanning your pc's that hasn't been defined ?

View solution in original post

3 Replies 3

jan.nielsen
Level 7
Level 7

You need to find more information about why they are getting there, from the logs you should be getting some idea.

You can create a new group with no rules, and just enable the log override for Log Set Actions, and then apply this group to just one host where you are having the problem, this will give you all the logs that do things like add an application to an application class, like untrusted or active network applications and so on, this would probably give you an idea what is going on.

Few things to consider :

- Are they being marked as untrusted before all this multiple policy viol. happens ?

- Are they being installed by an install manager that hasn't been defined correctly in csa ?

- Is there an inventory tool scanning your pc's that hasn't been defined ?

BTW, untrusted applications can be found by doing a host diagnostics from the hosts page in csamc, or looking in the local machines registry in HKLM\SYSTEM\CurrentControlSet\Services\csacenter\Persistent\@DownloadedDB

Many thanks for your help, this work around allowed me to work out what was going on here.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: