It seems if you set this setting to "audit" mode Cisco Secure Endpoint still displays an alert on the users endpoint for an "exploit prevention event". This will generate calls into the Service Desk.
Is there anyway to either supress this alert or stop this alert appearing as its in "audit" mode?
See attached pic Cisco Bug Discussions
