some of endpoints might be exposed to risk due to report-only policies

[Rehaman.Syed]

Dear Team,

While login my Organizational XDR Console, their is attention message display - Image added. 

If you guys having answer Please share to me - Thanks 

[jmazzeo]

Hi @Rehaman.Syed, thanks for reaching us using the live community.

That is only a warning message to let you know that you have policies with modules activated which are NOT in blocking mode as an action. For XDR, not blocking is a risk.

If you click in the "View" link, the console will filter these policies with the "report only" (check the yellow warning icon) action in any of the modules, then you can review them and, if needed, change the action.

Example screen:

Please let me know if this info ansers your question.

Thanks

[tlmarques]

i've the same problem....but in my case, i've solved the problem on policies, but the alert persist (during months)....i opened one case with support team today.

[S.Jatti]

I have been experiencing the same issue since this morning and would appreciate your insights on potential causes. In your experience, did this occur due to the policy being set to report-only mode, or were there any other scenarios that could have triggered this behavior?

[Karl-Foley]

We also see this, but only for the default policies that do not have blocking actions. It's annoying!