cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who Me Too'd this topic

App-id Adoption & App-id Reconciliation

L2 Linker

Hi guys,

I'm using the FW-logs in order to transform the security policies from legacy services towards app-id.

ML logs are onto the system etc.

Analysing rules via: R-click / App-id adoption / retrieve app (slow-fast) works fine.

Fi. Apps Splunk, ms-kms are detected.

When I convert the rule using "App-ID reconciliation / recommended", the service is converted to the detected app-id as-is.

However application dependencies are not taken into account?

fi. Splunk depends on web-browing, sms-kms depends on msrpc-base. This is leading to non-working policies.

 

I'm using Expedition: 1.1.42 (VM) and 1.1.46.1 (Physical server) both have the same behavior, while I believe this used to work in previous versions?

 

Thanks a lot,

Filip Elsen

 

Who Me Too'd this topic