Secure Endpoint - warn trusted

[cheivilin]

I am newer to the Secure Endpoint Product and cannot find int he user guide or our current documentation for a warn trusted cert.  I am assuming with the amount of software etc that is out there this could be a pretty normal occurrence and to keep an eye on this.  But wanted to get a objective opinion.

this is what i see with the device trajectory of the event:

File signed by Wavesor Software with certificate serial 04e41f85c676a21263778bd92dfbbbb8 from DigiCert EV Code Signing CA (SHA2). Expires 23:59:59, Wed Jan 25 2023 UTC. the certificate was warn trusted

[Troja007]

Hello @cheivilin ,
just wanted to check if I understood your question right. You want to configure some kind of rule which gives you an alert if a file with a specific certificate has been seen, right?
Greetings, Thorsten

[lajolla95]

NO i am trying to figure out if "warn trusted" is something i should be concerned with.

[Troja007 · Accepted solution]

Hello @lajolla95 ,
a certificate issue does not outline if there is a threat active on an endpoint. Even legitimate older software is signed with an outdated certificate. What type of events are shown for the particular endpoint? Is there an Inbox instance raised? What is the disposition of the file hash? Any insights from Threat Response? 

There are many options in Secure Endpoint showing you if there is something wrong with the endpoint, in addition to the Certificate information.
Greetings,
Thorsten

[cheivilin]

thank you very much.  MY assumption was this as it is built on IE 11 architecture for a third party software for automotive techs 

[Ken Stieers]

It means there was a cert warning but either the software overrode it, or a user ok'd it.
Wavesor is a maker of the Wave Browser... you'll want to get that off the machine.

[cheivilin]

thank you