# OfficeScan/security agent blocking packetbeat

**URL:** <https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989>\
**Category:** Beats\
**Created:** [June 16, 2016, 12:05pm UTC](https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989 "2016-06-16T12:05:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![talk2cshah](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\
**Post date:** [June 16, 2016, 12:05pm UTC](https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989/1 "2016-06-16T12:05:48Z")

</div>

Dear Team,

In one of our customer environment Topbeat is working perfect but packetbeat is behaving abruptly.  
On further investigation we saw urls referring officescan and mention of dll...

Has any one faced similar issue with packetbeat? with officescan or similar agent?  
I am thinking of requesting to exclude packet beat from scans...

Any specifics inputs and guidelines will help ...

Regards,

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 16, 2016, 12:36pm UTC](https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989/2 "2016-06-16T12:36:24Z")

</div>

So OfficeScan is false alarming on Packetbeat? Can you provide more specifics on what the alert was?

I don't recall anyone reporting anything similar before.

---

<div class="post-metadata">

**Author:** ![talk2cshah](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\
**Post date:** [June 17, 2016, 4:43am UTC](https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989/3 "2016-06-17T04:43:16Z")

</div>

HI,

I agree in terms of false alarm.. The first time urls are hit are notified but replaced with urls reference to officescan. no information is logged in logs..

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3935d4134278b0643a4fa543af694667126877f5.png)

Are there important pointers that we can inform infrastructure team while raising request to exclude from security checklist/ include in trust resource pool..

Regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2016, 12:05pm UTC](https://discuss.elastic.co/t/officescan-security-agent-blocking-packetbeat/52989/4 "2016-07-07T12:05:59Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.