topic Re: Do I Understand Profile Exceptions? in General Topics

Do I Understand Profile Exceptions?

charger — Mon, 22 Apr 2013 21:00:27 GMT

Hi,

Created a Vulnerability Protection profile.

Noticed that I was seeing a lot of "Microsoft Windows Registry Read Attempt" entries in the threat log. These appear to be benign. So I edited the profile, clicked the exceptions tab and checked the "enabled" checkbox for this vulnerability. I assumed this meant that this vulnerability would now be ignored and not show up in the log. This however is not the case. What am I missing?

Also

In the threat logging window, I click on a threat name and the threat details are displayed. One of the lower columns in the window is "Exempt Profiles". What exactly does this mean?

Any help is greatly appreciated.

Re: Do I Understand Profile Exceptions?

sraghunandan — Mon, 22 Apr 2013 21:04:11 GMT

Once you have enabled the vulnerability make sure that you allow it instead of the default action.

Re: Do I Understand Profile Exceptions?

charger — Mon, 22 Apr 2013 22:31:43 GMT

Thanks sraghunandan,

What about the second part of the question?

Re: Do I Understand Profile Exceptions?

cchristiansen — Wed, 01 May 2013 04:28:42 GMT

To answer your second question, the "Exempt Profiles" is where you can add an exception directly from that dialog. Click on it and configure that profile with exemptions. Hope this helps,

-chadd.