# Elasticsearch, APM Server, Metricbeat 6.5.1 and Symantec WS.Reputation.1

**URL:** <https://discuss.elastic.co/t/elasticsearch-apm-server-metricbeat-6-5-1-and-symantec-ws-reputation-1/157928>\
**Category:** Elasticsearch\
**Created:** [November 22, 2018, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-apm-server-metricbeat-6-5-1-and-symantec-ws-reputation-1/157928 "2018-11-22T18:37:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Behnam\_B](https://avatars.discourse-cdn.com/v4/letter/b/e99b99/32.png) [@Behnam\_B](https://discuss.elastic.co/u/Behnam_B)\
**Post date:** [November 22, 2018, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-apm-server-metricbeat-6-5-1-and-symantec-ws-reputation-1/157928/1 "2018-11-22T18:37:37Z")

</div>

The newest version of Elasticsearch, APM Server, and Metricbeat (v 6.5.1) causes Symantec to issue a WS.Reputation.1 and quarantine/delete the following .exe files:

path\to\elasticsearch-6.5.1\modules\x-pack-ml\platform\windows-x86\_64\bin\controller.exe  
path\to\apm-server-6.5.1\apm-server.exe  
path\to\metricbeat-6.5.1\metricbeat.exe

The symantec configurations are locked by our central security admin so I can not turn off Insight or exclude these folders from being scanned. Are there any other options? Is there plans to add these to Norton's trusted list?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [November 23, 2018, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-apm-server-metricbeat-6-5-1-and-symantec-ws-reputation-1/157928/2 "2018-11-23T09:39:51Z")

</div>

Thanks for letting us know. I've raised this with the wider team. Unfortunately false positives are a fact of life with this kind of security tool. I'm not sure what the next steps will be at this stage.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2018, 9:39am UTC](https://discuss.elastic.co/t/elasticsearch-apm-server-metricbeat-6-5-1-and-symantec-ws-reputation-1/157928/3 "2018-12-21T09:39:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.