topic Re: This alert appears directly in Endpoint

This alert appears directly

lluner — Tue, 25 Jun 2024 15:38:24 GMT

It's popping up this alert on harmony, I'm not accessing any unknown website

I'm guessing it might be a false positive, how to check in this case ?

Re: This alert appears directly

PhoneBoy — Tue, 25 Jun 2024 16:40:31 GMT

Potential false positives should be reported to TAC.

Re: This alert appears directly

JonnyRabinowitz — Tue, 25 Jun 2024 17:00:05 GMT

The file is being flagged by the Reputation service based on the hash

It look to be a false positive. I have opened a case to have this investigated and will share any updates on the ticket

Also if you can confirm as FP from your perspective you can define an exception; potentially for the directory

File is c:\users\cgond\appdata\local\microsoft\edge\user data\default\cache\cache_data\f_01522b

Re: This alert appears directly

the_rock — Tue, 25 Jun 2024 17:04:27 GMT

I think you probably meant frequently, rather than directly, but either way, you got an excellent response from @JonnyRabinowitz

Best,

Andy

Re: This alert appears directly

JonnyRabinowitz — Tue, 25 Jun 2024 18:11:02 GMT

I have had confirmation that this is a false positive and has been cleaned. However, the verdict is cached at the endpoint and think it takes about 2 days until the cache is cleared

Re: This alert appears directly

lluner — Tue, 25 Jun 2024 19:35:04 GMT

tks @JonnyRabinowitz