CSA Virus:Behavior.Excessive Policy Violations

[ivickery]

Hi,

I have noticed a number of these surfacing in the quarantined applications.

Is there a way to tune this to prevent this from reocurring across all of the desktops.

As far as I can tell these events are not been recieved by the CSA server. i.e. Loging must be disabled for this event.

[jan.nielsen · Accepted solution]

You need to find more information about why they are getting there, from the logs you should be getting some idea.

You can create a new group with no rules, and just enable the log override for Log Set Actions, and then apply this group to just one host where you are having the problem, this will give you all the logs that do things like add an application to an application class, like untrusted or active network applications and so on, this would probably give you an idea what is going on.

Few things to consider :

- Are they being marked as untrusted before all this multiple policy viol. happens ?

- Are they being installed by an install manager that hasn't been defined correctly in csa ?

- Is there an inventory tool scanning your pc's that hasn't been defined ?

[jan.nielsen]

BTW, untrusted applications can be found by doing a host diagnostics from the hosts page in csamc, or looking in the local machines registry in HKLM\SYSTEM\CurrentControlSet\Services\csacenter\Persistent\@DownloadedDB

[ivickery]

Many thanks for your help, this work around allowed me to work out what was going on here.