About chsmith

Hi Jimmy,   As SvenMik suggests, there isn't currently a configuration option to control the size of the Forensics folder on the ESM itself.   As far as I'm aware, the location of this folder can be configured to wherever you prefer.   We do recommend periodically removing old uploads from this directory on the ESM - a simple script can be configured to do so automatically.  Support can provide you with an example designed to be run as a Windows Scheduled Task. ... View more

Hi Roland,   Though Local Analysis is built to operate (in part) like the WildFire Cloud does, the resource constraints inherent in running this on a single Endpoint in conjunction with the static nature of the module mean that certain properties that appear malicious will tend to trigger a prevention event (erring on the side of caution rather than allowing something through).   One major goal of Local Analysis is to limit the time that a new process hash is considered "unknown" (making this component much more flexible than it was previously, where the only options - when dealing with a new hash, or lack of connectivity to the ESM or WildFire - were to block or allow processes until a WildFire verdict was received).   Some of this may be tuneable (depending on your current policy configuration), but I'd recommend reporting these events to Support to investigate (and ensure these events are incorporated into future updates to the Local Analysis model).   --Chris ... View more