cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
271
Views
0
Helpful
1
Replies

Question about rule override in CSAMC

beckman.yang
Level 1
Level 1

Dear Sir ,

After changed from audit to learn mode and polled policy in client ,audit mode still running at hosts status in CSAMC.

Have any suggestion to resolve it ?

thanks

Best regards

1 Reply 1

tsteger1
Level 8
Level 8

Make sure they have polled since the change and that they aren't still in a group that's in audit mode.

Group Audit Mode overrides everything else and all rules will be in Audit Mode for that host.

Tom