Best Of
Re: Linux Agent LS64 Changelog (Elements, Business Suite, Standalone)
F-Secure Linux Security 64 Update 12.0.35 Release Notes
Change Log
- CSLP-3327: Uninstalling Linux Security 64 now properly stops and removes all the associated services.
- CSLP-3289: Alerts are now visible in system log.
Known Issues
- CSLP-3319: Manual scanning cannot be invoked from Policy Manager Console.
- CSLP-3320: Scheduled scanning reports do not contain checksums of the detected files.
- CSLP-3321: Scheduled scanning reports do not contain engine names and versions.
- CSLP-3322: Command-line and scheduled scanning also applies malware actions to files that are part of integrity checker baseline.
- CSLP-3323: Manual channel updates cannot be triggered from Policy Manager Console.
Samuel_L
Re: Antivirus deleteing teamviewer .exe file cannot exclude.
Hi,
I downloaded the Teamviewer client v. 14 and could not immediately reproduce your problem. Would it be possible for you to submit the false positive file (the exe that gives you trouble) for our labs at https://www.f-secure.com/en/web/labs_global/submit-a-sample.
Maaret
maaretp
Re: How do I block a smartphone on PSB
Hi Carlos2285
To block/disable mobile phone via Device Control from PSB web portal, you need to block the following device classes.
Please add a device access rule as below, and let me know if it works:
Display name: Mobile Phone storage
HardwareID: USB\Class_FF
Access level: Blocked
Repeat this rule with the below mentioned device classes to block all smart phones:
HardwareID: USB\Class_00
HardwareID: USB\Class_08
HardwareID: USB\Class_02
HardwareID: USB\Class_EF
JamesC
Re: Quarantine rules for Fw | CS 14.02
Hello Vincent,
Network isolation rules are the firewall rules applied when a managed host gets isolated. It can become isolated either due to Network quarantine feature when certain criteria are not met, or get isolated manually by Policy Manager administrator using Operations > Network isolation > Isolate remote operation. The same isolation rules will be applied in both cases.
Best regards,
Vad
Vad
Re: F-Secure: left hand doesn't know what the right hand is doing? (PSB remote FSDIAG confusion)
Hi Tamas,
As MonikaL shared, obtaining the file samples during the first stage would be the most efficient way to resolve a false positive case.
The binaries are required for us to debug how the false positive may occur in a particular file and then apply the necesary fixes, while keeping the protection on a good level to still detect valid malware samples.
In some cases, the samples may be publicly available or already in our backend. I would recommend whenever possible to provide at least the file hash (SHA1) when filing a false positive case, so that we can check if the sample is already available to us.
The PSB Management API documentation contains some examples on how to generate a report containing the detection details (including SHA1) programmatically:
https://help.f-secure.com/product.html?business/psb-rest-api/1.0.0/en/concept_216D5455656A49A38AA049D6C7B37427-1.0.0-en
For cases where the sample is not available to us (e.g. internally-developed software), there's an easy-to-use F-Secure tool available that we recommend to both Home and Corporate users to utilize in order to safely retrieve the quarantined files before submission.
The tool would have to be executed at the endpoint where the samples were quarantined, and its usage instructions are described here:
https://community.f-secure.com/t5/Common-topics/How-do-I-collect-quarantined/ta-p/78104
As PSB currently doesn't feature remote sample submission capabilities, I hope you find the above information useful for the time being.
Re: Quarantine rules for Fw | CS 14.02
Hi Vad,
This is exactly what we were waiting for...
And it works perfectly...
Thank you.
Re: HTTPS Communication to PolicyManager 14.20
There is no client certificate to be distributed.
The server has a self signed certificate.
ClientSecurity "knows" the certificate that is in use, so what you see is only from a browser.
If you prefer you can replace that with a company certificate.
If your Clients are V14 they will automatically switch to https
Port 80 will only be used for Updates.
Re: FW rules from 13 to 14
- You can have different profiles for 80 and 20 clients.
- To minimize effect of Microsoft rules you can check the checkbox "Ignore all firewall rules that are not listed in this profile".
Best regards,
Vad
Vad
Re: Endpoint Security Portal (formerly Endpoint Protection Portal) Changelog
Hi,
new release will be rolled out to all portals in next few days with folloging changes:
New features:
- Mobile devices can be searched by UDID.
- Added operating system build number to the computer device listing.
Fixed issues:
- Exported CSV report from infection tab does not include Computer name.
- If Server Security subscription is upgraded to Server Protection Premium, profile assignment option is not available for old Server Security 12.
- Portal UI displays "No Premium subscription" for Server Protection Premium products.
- Request fsdiag operations status handling fixed and no longer loses statuses.
PSB Team