OfficeScan/security agent blocking packetbeat

Elastic Stack Beats
1

Dear Team,

In one of our customer environment Topbeat is working perfect but packetbeat is behaving abruptly.
On further investigation we saw urls referring officescan and mention of dll...

Has any one faced similar issue with packetbeat? with officescan or similar agent?
I am thinking of requesting to exclude packet beat from scans...

Any specifics inputs and guidelines will help ...

Regards,

2

So OfficeScan is false alarming on Packetbeat? Can you provide more specifics on what the alert was?

I don't recall anyone reporting anything similar before.

3

HI,

I agree in terms of false alarm.. The first time urls are hit are notified but replaced with urls reference to officescan. no information is logged in logs..

Pasted image1043×259 18.5 KB

Are there important pointers that we can inform infrastructure team while raising request to exclude from security checklist/ include in trust resource pool..

Regards,

4

This topic was automatically closed after 21 days. New replies are no longer allowed.