Tailored Safe -- 0 Hits

[Paul_Warnagiris]

Good Evening Check Mates!

I have been working with Tailored Safe at a few clients now for a couple of days.  The concept is awesome and I'm enjoying digging in.  I do have a question though.  At three out of three customers I come back with IPS Protection recommendation (without hits).  In other-words there are recommendations to turn on preventions with out casing risk to the org.  That is great.  However, moving from detect to prevent (with hits) and application discovery there are no recommendations.  Is this iterative?  In other words I first have to turn on the protections without hits?  Then the next time I run it I will see detect to prevent "with hits?"  And the next time I will see applications?  Or am I missing something?  I appreciate any feedback.  I have reviewed sk164812 and I understand this is not a one time process, but just trying to understand what I'm seeing.  I would have thought there would be some detects with hits and applications discovered on the original go-round.

Please let me know if I'm off base.

Thanks,
Paul

[Paul_Warnagiris]

Anyone have any input here?

[Tal_Paz-Fridman]

Hi - adding @Adi_Ikan and @Avraham_Bechor 

[Avi_Bechor]

Hi Paul,

Glad that you enjoyed Tailored Safe and find it valuable. We would be happy to cooperate and assist. We will contact you internally to further discuss this.

Thanks,

Avi

[Conor_Mulcahy]

Hi, I've been having same issue as described above, is there a fix for this?

[Paul_Warnagiris]

I did a remote session with them.  They understand the problem and are working on it.  I have not had a follow up as of yet.

[Avi_Bechor]

Thanks Paul for the fruitful session over Tailored Safe, we have taken your notes and are currently working on developing those for your specific scenarios. We will keep you posted in the mail regarding the progress.

Thanks
Avi

[Anthony_Harvey]

Very interested in this as well.

Would like to see/understand more of how the platform & feature are evolving to help with data correlation that is already in the platform.

[Dale_Lobb]

So, what was the issue and the solution, assuming one was provided?

The problem with offline conversations like these is that the rest of the community does not benefit from accumulated, recorded knowledge.

[Avi_Bechor]

Following the discussion on a few previous issues, we had a few developments, most notably the ability of selecting a custom Tailored Safe profile as a base profile.
AFAIK there are no issues on the matter with the available version of Tailored Safe

We will always be happy to hear any relevant feedback

Thanks,

Avi