About mmoshiri

Hi Ari,   You are correct... this isn't the best forum to discuss the issue you're encountering. The best place to post this request (and report the issue) is in the Traps Beta forum.    Also, when you repost your request there, please be sure to indicate if the dbkextd process you're referencing is actually malicious or not. From your ESM screenshot, it looks to me that WF has identified it as malicious. But your description makes it sound like it might not be ("... what updating Dropbox looks like... ").   ... View more

I suspect whitelisting ccmexec.exe won't achieve the goal you have in mind. That will allow that particular application to run, but depending on your policies (execution restrictions), Traps may block the execution from Temp folders.   Ultimately, you are looking to whitelist the corporate apps that will be running, not ccmexed.exe, right?   Here are a few of suggestions: If these apps don't change often, whitelist their hashes by adding an Admin Override Policy (in the Hash Control table) for each application. That will allow them to run anywhere in the environment. If it is possible to control which folder these apps are executed in when they are downloaded, I would choose a specific folder (other than C:\Temp and other "standard" temp directories) and whitelist the folder as well (in Execution Restrictions). If these apps change often, run them on a Traps-protected machine (anywhere in your environment) before distributing them. That way, you can ensure that if they are blocked by Traps for whatever reason (and are presumably quarantined), your admins can restore the apps and thereby whitelisting them across the environment. Keep in mind that the Execution Restrictions are always checked, regardless of which other malware prevention methods are invoked. So be sure to verify these restrictions match what you're looking to set up.  ... View more

Hi Tim,   Traps can actually relay its logs via syslog protocol to any SIEM that can ingest the data. Look under the Settings tab of the ESM, then click on the Syslog item in the list. .     The Panorama integration is something our teams are working on. I don't have much information on that to share at the moment... ... View more