To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

dl.delivery.mp.microsoft.com cache site marked as harmfull

Jan-Eric
Jan-Eric Member Posts: 16 Cyber Knight
edited June 2024 in Elements Endpoint Detection and Response (EDR)

Microsoft seems to have outsourced their updates distribution and this gets blocked.

How do I allow this traffic as it's a IP address that's changing?

WithSecure Elements Endpoint Protection har nya identifieringar:
Tid|Konto|Värd|Infektion|Åtgärd|Typ|Infekterat objekt|Infekterat objekt SHA1
fre, 10 maj 2024 19:58:48 UTC|xxxxx|xxxxx|hxxp://151.139.186.70/filestreamingservice/files/958e01e9-b772-4ce0-afae-451ac416cb3f/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com|Blocked|Web_traffic_scanning.content_type.block|None|

Best Answer

  • Jan-Eric
    Jan-Eric Member Posts: 16 Cyber Knight
    Solved

    No problem so far after I added IPs (url) from 151.139.186.x subnet to allowed sites.

    I would be nice a nice feature to be able to add IP subnets to Browsing protection/Allowed sites.

Answers

  • JamesC
    JamesC Staff, Moderator Posts: 559 W/ Moderator

    Hi @Jan-Eric

    My sincere apologies for the inconvenience and thank you for reaching out to WithSecure Community.

    Our detection team have now fixed the URL to be clean.

    Do check this and let us know if issue persists.

  • Jan-Eric
    Jan-Eric Member Posts: 16 Cyber Knight

    There are more IPs and cacheOriginHosts but Microsoft doesn't publicly list their cache IPs. But fot thr moment they all seems to originate from 151.139.186.x subnet.
    hxxp://151.139.186.28
    hxxp://151.139.186.38
    hxxp://151.139.186.41
    hxxp://151.139.186.42
    hxxp://151.139.186.71
    hxxp://151.139.186.74
    cacheHostOrigin=msedge.f.dl.delivery.mp.microsoft.com|
    cacheHostOrigin=officecdn.microsoft.com
    cacheHostOrigin=download.windowsupdate.com

  • JamesC
    JamesC Staff, Moderator Posts: 559 W/ Moderator

    Hi @Jan-Eric

    If you are still having issues, we suggest to use the Submit-a-Sample feature so our detection team can investigate further

  • JamesC
    JamesC Staff, Moderator Posts: 559 W/ Moderator

    Hi @Jan-Eric ,

    Glad to hear there are no further issues. You may refer the below to submit a Feature Request:

    • If you are using our business security products you can directly raise a feature request aka ideas directly via Elements Security Center > Profile logo( top right corner)> My Feedback functionality. which takes the portal user to .
    • Or get in touch with sales contact. If you do not know who your WithSecure sales contact is or are unable to reach them, please open a support ticket and your feature request will be relayed to the developers: 

    https://ideas.withsecure.com/ https://www.withsecure.com/us-en/support/contact-support/email-support

Categories