Detect in Log and Prevent in Report. How can it be?

[Evgeniy_Olkov]

Hello. I need some help with Threat Emulation. Our customer have a couple of incidents with virus prevention.

A virus file can pass check point with detect in logs:

Matched Rules:

Rules:

Severity - Critical, Confidence Level - High. Threat Prevention profile:

At the same time if we open summury report we see Prevent:

What is wrong? Antivirus does not blok this file too.

[Kaspars_Zibarts]

Just with a quick glance - Threat prevention profile shows "Standard" and next screenshot profile name is different

[Evgeniy_Olkov]

Sorry for that, it's just an example. I have not an original screenshots (just for now). 

[Danny]

It's all in the details. Actual screenshots showing your real sypmtoms will allow us to help you. Please replace the examples above with your real screenshots.

[Evgeniy_Olkov]

I have updated screenshots

[PhoneBoy]

Did the end user in question actually receive the document?

[Evgeniy_Olkov]

Yes. Local antivirus detect it in received email.

Actually I have noticed that our other customer has the same problem. 

[PhoneBoy]

I could see the Forensics piece saying prevent if AV ultimately caught it (even if TE didn’t).

A TAC case is probably warranted here.

[Evgeniy_Olkov]

Yes, I have created TAC case. They are going to organize remote session. I'll share the answer after.