topic Script process protection in AMP for Endpoints in Endpoint Security

Script process protection in AMP for Endpoints

pavankumar.kakarla — Wed, 15 Jul 2020 17:24:17 GMT

We have enabled Script process protection feature in our environment, however we dont see any filter for this feature under "Events" tab. How can we filter or find the script process protection alerts on AMP console for our machines.

Re: Script process protection in AMP for Endpoints

Matthew Franks — Wed, 15 Jul 2020 17:57:38 GMT

It is listed under System Process Protection.

Thanks,

Matt

Re: Script process protection in AMP for Endpoints

pavankumar.kakarla — Wed, 15 Jul 2020 18:20:49 GMT

Thanks Matt for the response!!

We see only "System process protection" and not "Script process protection". Incase if its a subset of "System process protection" feature how do we see a particular alert for "Script process protection". Please guide me here.

Re: Script process protection in AMP for Endpoints

Matthew Franks — Wed, 15 Jul 2020 19:02:01 GMT

Sorry for the confusion, I misread your post. The Script Protection events will be under Threat Detected or Quarantine events, they are not listed separately at this time.

Thanks,

Matt

Re: Script process protection in AMP for Endpoints

Troja007 — Mon, 20 Jul 2020 06:13:54 GMT

Hello @pavankumar.kakarla,

als @Matthew Franks already explained, today Script Protection is focusing on Scanning Files provided by Microsoft AMSI. Therefore it is shown as a File Detection Event. This is the actual Product Design of the Engine.

This may change in future releases of the engine.

Greetings,

Thorsten