topic Re: Allowing ms-update on app-default, File blocking PE and therefore no windows updates in Advanced Threat Prevention Discussions

Allowing ms-update on app-default, File blocking PE and therefore no windows updates

drewdown — Wed, 23 Aug 2017 18:56:41 GMT

New PAN implementation and blocking per PA best practice (PE, multi-level, etc..) and allowing ms-update on application default. However the WSUS server is not able to download any updates and its classifying a PE file as a threat. The file in question is am_delta_patch_1.249.1313.0_52b04aae0eb450654fc89884b43d10b7ed5 and threat-id is 52060 but nothing matches in the Threat Vault.

Do I need a specific rule allowing windows updates that allows PE files?

Re: Allowing ms-update on app-default, File blocking PE and therefore no windows updates

AndyYerger — Thu, 07 Dec 2017 17:21:24 GMT

Go to Objects ,File Blocking and create a new File Blocking policy. In that policy add in Application ms-update then the next tab File Types add PE and allow . Then Go to security policy in Polices the Security tab and create a rule for your WSUS server and make sure the file blocking policy in that rule is off or you use the new File Blocking policy you created.

Re: Allowing ms-update on app-default, File blocking PE and therefore no windows updates

Randnabeel8 — Wed, 07 Nov 2018 08:13:19 GMT

it's can't solve the issue of MS-update

Re: Allowing ms-update on app-default, File blocking PE and therefore no windows updates

AndyYerger — Sat, 01 Dec 2018 03:47:42 GMT

Yes a rule would help. Go to security policy in Polices the Security tab and create a rule for your WSUS server and make sure the file blocking policy in that rule is off . Then move that rule to the top of your security policies right under any block rules you may have in those policies.