topic Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working in Endpoint

Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Markus_Hoyer1 — Thu, 28 Jun 2018 10:35:36 GMT

Hi CheckMates

I have an issue regarding endpoint client version E80.81.

When we're downloading files from microsoft dynamics over web it takes forever to do the security scan for safe download, furthermore when downloading Excel files it removes all the content within the spreadsheet.

I've tried adding domain exclusions and specific URL exclusions but it still decided to do the scan...

I see no reason for scanning files from within our own domain and would like to be able to configure this.

What policy / software is it using for scanning files when being downloaded, I might have made the exclusions in the wrong blade.

First I thought it might be the TE blade, but when looking at logs the scans aren't with the same timestamp as with when the scan was done. (There's no missmatch in server time and real time)

Hope you can help

Kind regards

Markus

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Steve_Lander — Thu, 28 Jun 2018 13:09:03 GMT

Have you tried adding *.domain.com or domain.com/* in the Sandblast Agent Threat Extraction and Emulation Blade? That is the blade that scans the files that are being downloaded. If that doesn't work, I would test upgrading a computer to a newer version of CP Endpoint to E80.84 with the same exceptions, and see if it works then. I have seen some wonky stuff with exceptions not working sometimes, you may have to try adding different combinations of urls, such as dynamics.domain.com if *.domain.com doesn't cover that, which it should.

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Markus_Hoyer1 — Fri, 29 Jun 2018 13:15:00 GMT

Hi Steve

Thank you for your reply, I had a talked with TAC yesterday regarding this issue.

I had added the exclusions as *.domain.com, but was told that this wasn't the way to do it, but only to add them as domain.com. It seemed to worked, but I am still having issue. See SK: 128472

SandBlast Agent (Forensics & Anti-Ransomware, Anti-Bot, Threat Emulation) - Exclusions

Do anyone know how to excluded, IP addresses, Hostname and NetBios name?

kind regards

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Steve_Lander — Fri, 29 Jun 2018 14:08:58 GMT

It is possible to add IP addresses as exclusions in the Threat Extraction and Emulation. You can try that as see if that fixes your issue.

The info about not using wildcards before the domain name is a little bit alarming, as thats what I have here for some of our domains. As we are having issues with some things still getting scanned internally, maybe taking the wildcard out will fix that.

Thanks for the reply!

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Markus_Hoyer1 — Fri, 29 Jun 2018 14:12:40 GMT

I agree, since I also used wildcards in the beginning.

How did you add IP addresses in my manager I can only choose between these three:

Domain exclusions - Relevant only for the SandBlast Agent Extension for Browsers.
SHA1 exclusions - Relevant only for Threat Emulation blade (File system monitoring)
Folder exclusions - Relevant only for Threat Emulation blade (File system monitoring)

I am running R77.30.03

kind regards

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

Steve_Lander — Fri, 29 Jun 2018 20:29:04 GMT

I put the IP addresses in under Domain Names and they were able to be added. Since hearing wilcards are not allowed (presumably) under the category Domain Names, I'm not entirely sure if using IP Addresses will work as expected, but its worth a try.

Could anyone from CheckPoint weigh in on if this is possible or not? Maybe consider adding IP Addresses as a feature in the management console.

We are running R77.30.03 as well, waiting to jump to R80.20 once its optimized for the Endpoints.

Re: Endpoint E80.81 downloading security scan takes for ever + domain/URL exclusions not working

PhoneBoy — Wed, 04 Jul 2018 00:32:49 GMT

R80.20.M1 is available now and includes Endpoint Management.

The way I understand it is if you just use the domain (e.g. example.com) it applies for all hosts in that domain (e.g. host.example.com).