Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Rapid Config Rules Still Block or Report Despite Being Disabled

App Control: Rapid Config Rules Still Block or Report Despite Being Disabled

Environment

  • App Control Agent: 8.6.x, 8.7.2 - 8.7.6

Symptoms

Previously enabled Rapid Config or other rules still trigger block or report events despite being disabled in the web console

Cause

There is an issue introduced in agent version 8.7.2 that in rare cases prevents purging of previously enabled Rapid Configs or other rules (config lists)

Resolution

Please create a support ticket and request from Support to provide you with the SQL script to purge any outdated rules (config lists) from the affected agents

Additional Notes

This issue EP-15608 will be resolved in agent version 8.7.8

These prevention steps will ensure that no outdated rules remain active on the agents until 8.7.8 is released:
  1. Always use up-to-date policy installers downloaded from the server from this URL > https://APPCSERVER/hostpkg
  2. Server-side > Go to > https://APPCSERVER/Shepherd_config.php > check if the property "EnableConfigListFullImport" is set to: true > if so, set it back to: false
  3. Agent-side > avoid using the command: dascli importconfiglist


 

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-25-2022
Views:
105
Contributors