ManageEngine Endpoint DLP policy and Cisco AMP coexistence issue

[Easwar]

When Endpoint DLP policy by ManageEngine injects dll's into processes to monitor sensitive file transfer actions or events, Cisco amp kills the process where the dll is injected into. There is no option to exclude dll injections from specific vendors or whitelisting the dll themselves using any signature. What can be done for this case?

[Matthew Franks]

It seems like ManageEngine is offering similar protection as Exploit Prevention.  You can disable one of the two so they are not competing, or you can open a TAC case and they can add a DLL exclusion in Exploit Prevention from the backend. 

Thanks,

-Matt

[Troja007]

Hello @Easwar, qq, can you please explain some more details about "kill process"?? Which process gets killed? the ManageEngine process?? Is there any Event shown in the Secure Endpoint console?
Greetings, Thorsten