topic Re: Secure Endpoint - warn trusted in Endpoint Security

Secure Endpoint - warn trusted

cheivilin — Tue, 11 Jan 2022 15:20:54 GMT

I am newer to the Secure Endpoint Product and cannot find int he user guide or our current documentation for a warn trusted cert. I am assuming with the amount of software etc that is out there this could be a pretty normal occurrence and to keep an eye on this. But wanted to get a objective opinion.

this is what i see with the device trajectory of the event:

File signed by Wavesor Software with certificate serial 04e41f85c676a21263778bd92dfbbbb8 from DigiCert EV Code Signing CA (SHA2). Expires 23:59:59, Wed Jan 25 2023 UTC. the certificate was warn trusted

Re: Secure Endpoint - warn trusted

Troja007 — Wed, 12 Jan 2022 13:54:12 GMT

Hello @cheivilin ,
just wanted to check if I understood your question right. You want to configure some kind of rule which gives you an alert if a file with a specific certificate has been seen, right?
Greetings, Thorsten

Re: Secure Endpoint - warn trusted

lajolla95 — Thu, 13 Jan 2022 15:13:56 GMT

NO i am trying to figure out if "warn trusted" is something i should be concerned with.

Re: Secure Endpoint - warn trusted

Troja007 — Fri, 14 Jan 2022 13:29:12 GMT

Hello @lajolla95 ,
a certificate issue does not outline if there is a threat active on an endpoint. Even legitimate older software is signed with an outdated certificate. What type of events are shown for the particular endpoint? Is there an Inbox instance raised? What is the disposition of the file hash? Any insights from Threat Response?

There are many options in Secure Endpoint showing you if there is something wrong with the endpoint, in addition to the Certificate information.
Greetings,
Thorsten

Re: Secure Endpoint - warn trusted

Ken Stieers — Fri, 14 Jan 2022 19:20:34 GMT

It means there was a cert warning but either the software overrode it, or a user ok'd it.
Wavesor is a maker of the Wave Browser... you'll want to get that off the machine.

Re: Secure Endpoint - warn trusted

cheivilin — Mon, 17 Jan 2022 17:09:56 GMT

thank you

Re: Secure Endpoint - warn trusted

cheivilin — Mon, 17 Jan 2022 17:10:54 GMT

thank you very much. MY assumption was this as it is built on IE 11 architecture for a third party software for automotive techs