Reverse AMP File Conviction

ITGuyCSI25 — Fri, 21 May 2021 15:31:31 GMT

Hey People,

My Engineering department makes custom applications, and uses GIT sources for applications. Most of the time they're doing things as will, and AMP is convicting these applications as Malicious before I can whitelist the applications. How can i reverse the convictions? Adding the applications to the application allowed list doesn't stop the AMP from blocking them and quarantining the applications.

Any help would be appreciated, thanks.

Re: Reverse AMP File Conviction

ppreenja — Thu, 03 Jun 2021 09:06:06 GMT

Hello,

You might need to check on the event details to see which engine (such as MAP or Exprev etc.) is blocking the application.

You can try and make any of the below methods to avoid any conviction for the files:

Scan Exclusions: Files/Path is not scanned, not hashed - related to any engine doing file scanning.
Process Exclusion: Anything done by a running process is not scanned.
Application Whitelisting: has an impact on two things
- Behavioral Engines (e.g. Machine Learning) exclude the hash
- The connector does no cloud lookup for the hash
Engine specific process exclusions: The exclusion works for a specific engine

I hope the above helps.

Cheers,

Pratham

topic Re: Reverse AMP File Conviction in Endpoint Security

Reverse AMP File Conviction

Re: Reverse AMP File Conviction