problem endpoint signature generating large number of false positives?

[LazarusG]

Hi

We have a couple of customers reporting high attack rates in the portal and many applications being quarantined on their endpoints.

Doesn't seem to be any chatter on here - is anyone aware of a problem signature released into the wild or is their something more nefarious going on?

Thanks

[_Val_]

Not something known. If any doubt, reach out ot TAC and (probably) IR

[the_rock]

When did this start happening?

[LazarusG]

just getting wind of it from two customers in the last hour or two.

[the_rock]

Will check later with one of our clients, still early here : - )

Andy

[LazarusG]

both seem to be having high incidence of Protection name Gen.ML.SA - both will be logged to tac

[the_rock]

Is there something you see in the portal itself or mostly on endpoint side of things? I ask that, because I have access to this customer's portal on the cloud, so can check any time.

Andy

[LazarusG]

logs for blade:forensics - TAC have responded saying its a known issue.

[the_rock]

Thanks for the update, appreciated!

[m25487]

We also have elective files in quarantine. Is there anything we can do?

[the_rock]

Lets see if something official comes out in the meantime...

[LazarusG]

sorry to hear that = guidance on my side is wait for official comment/fix

[LazarusG · Accepted solution]

TAC update from an hour ago;

"We have a fix for this global issue now. The clients will be upgraded automatically in the next 2-3 hours".

They say there is a script for if you need it more urgently. 

[the_rock]

Is the script public (ie part of sk) or has to be requested?

Andy

[LazarusG]

im unaware of an SK so assume tac request - also wondering if the quarantined files will be released without intervention....

[the_rock]

Yea...super valid point @LazarusG 

[LazarusG]

I suppose you could use a push operation to release quarantined files
Push Operations

else the AdminRemediationManagerUI.exe ..

But am not sure how things look in the customer estate now.

They did confirm no more logs since about 2hrs ago.

[the_rock]

Thats true...IM not harmony endpoint guru by any means, but I do recall that sometimes even push operations can take some time and then eventually fail.

Andy

[the_rock · Accepted solution]

I also ended up opening TAC case for this today and they confirmed issue was fully fixed.

Andy

[Tom_Hinoue]

We still have some customers that reported their applications are still quarantined even at this time.
Did TAC mention anything about what we need to do on client side like rebooting or manually updating the client status?

It's not realistic to release each app from quarantine with push operations.
There are dozens of apps that are quarantined on 1 client times by the number of actual customer devices..

Note, we already have a TAC case opened and pending their update.

[Tom_Hinoue]

I just received an update from TAC.
We were provided with a script to release files from quarantine... will look into it now.

[the_rock]

That should help, for sure. You are 100% right about push operations...thats not really a viable option, specially in this case.

Andy

[the_rock]

TAC lady told me they are advising customers to contact them and ask for script if issue is still there.

Andy