false positives with CSA

dave.thornton — Sun, 10 Mar 2019 09:18:53 GMT

CSA generates Warnings along the lines of:-

An unauthorized Network Component, 'NDIS Proxy' was detected registering with the system. The operation was permitted. Details Rule 424

An unauthorized Network Component, 'QoS Packet Scheduler' was detected registering with the system. The operation was permitted. Details Rule 424

Typically I get 4 of these per reboot on a number of systems; these systems are healthy and need NDIS proxy and Qos Packet scheduler etc in order to work....

SO I think these are false positives and would like them NOT to generate noise....

The problem is i dont want to turn off Rule 424 if its needed and wonder how to work around the issue.

There seems no obvious way to stop the logging or exclude the applications in question; the only option is to enable/DISable the rule....

any ideas or suggestions welcomed.

thanks

dave

Re: false positives with CSA

tsteger1 — Mon, 07 Mar 2005 20:27:32 GMT

You don't need to disable it. Change the Sniffer and protocol detection rule to exclude those protocols.

Tom

topic false positives with CSA in Network Security

false positives with CSA

Re: false positives with CSA