11-06-2019 07:08 AM
Hi guys,
I'm using the FW-logs in order to transform the security policies from legacy services towards app-id.
ML logs are onto the system etc.
Analysing rules via: R-click / App-id adoption / retrieve app (slow-fast) works fine.
Fi. Apps Splunk, ms-kms are detected.
When I convert the rule using "App-ID reconciliation / recommended", the service is converted to the detected app-id as-is.
However application dependencies are not taken into account?
fi. Splunk depends on web-browing, sms-kms depends on msrpc-base. This is leading to non-working policies.
I'm using Expedition: 1.1.42 (VM) and 1.1.46.1 (Physical server) both have the same behavior, while I believe this used to work in previous versions?
Thanks a lot,
Filip Elsen
