[Populate blocked address list automatically]

Sorry, this is still a manual process (login to ESMC, edit policy, browse url list, save policy).
Is there a way to specify an url or specify a local text file path, where the url/text file contains the addresses to be blocked, and ESMC reads/updates the policy from them automatically?
And I would need to update that url or local text file with the new malicious urls without logging in to ESMC.

[Populate blocked address list automatically]

I would like to block addresses with Web Access Protection / Url list.
Addresses can be added manually to it, but is there a way to automate?
For example feeding the list from an url or a local text file.
Is there a similar/equivalent feature?
 

thanks

[Block Adobe Reader from creating child processes - ESET PROTECT]

Just checked this: https://help.eset.com/ees/10.1/en-US/idh_hips_editor_main.html

Maybe this works with 2 rules:
1. Allow rule, source: adobereader.exe, child: the allowed specific apps
2. Deny rule, source: adobereader.exe, child: all apps (lower priority, since this less specific)

[Block Adobe Reader from creating child processes - ESET PROTECT]

I found only one "Exclusions" box in the  "HIPS\Deep behavioral Inspection" section.

Staying with the above example, creating a HIPS rule, where the source app is the adobereader executable, and the child app is "All applications", the above excluded applications will be excluded?

Or there is no way to apply a HIPS rule to all child processes with some exceptions?

 

[EES doesn't evaluate correctly Windows Firewall rules]

Hello

Client: Windows 10 21H2, Eset Endpoint Security 10.0.2045.0

Network Access Protection / Firewall / "Also evaluate rules from Windows Firewall" is enabled

Opened a port locally on the client in Windows Firewall, scope is set to "any" remote ip address. (a service is listening on that port)

In this case the port is open, when checked from a remote address, as expected.

If I specify an ip address on the Scope tab, the port is closed when I try to telnet from that ip.

If I create a local rule on the client, Eset/Network/etc, opening the same port with the same remote ip, it works fine.

Enabled debug logging on the client, and when the connection is blocked this message is appeared:
"No usable rule found"
Source is [remoteip:remoteport], where remoteip is what I added to windows firewall/rule/scope tab/remote ip address.

So it looks like the "evaluate windows firewall rules" only works if there is no remote ip address is set.

Reproduced this issue on two computers.

thanks,
ludolf

[HIPS blocks Windows Defender installation]

There is no other issue with them, they can run paralell.

[HIPS blocks Windows Defender installation]

Tyring to use both solution. There are features in them, which is missing in the other. 

[HIPS blocks Windows Defender installation]

Hello

Initial state: Windows Server 2016 without windows-defender feature, Eset Server Security 9.0.12013 with enabled HIPS

If I try to install Defender (install-windowsfeature windows-defender), it requires a restart, and after the restart it is not installed.

Noticed, that disabling Eset HIPS for the installation solves the issue.

Enabled HIPS / blocked events logging and tried again. 

It logged this event during the defender install: 

12/7/2022 4:38:42 PM;C:\Windows\System32\poqexec.exe;Get access to file;C:\Windows\ELAMBKUP\;Blocked;Self-Defense: Protect ESET files;Write to file

So added the poqexec (full path) to the rules, with "All file operations" and target files: C:\Windows\ELAMBKUP\WdBoot.sys. Still blocked.

Changed target files to "All target files", still blocked.

Turned out that the HIPS' "Self defense" function is the culprit, and if it is enabled, the above allowed rules are completely ignored.

Is this a bug or the expected operation? 

thanks

 

 

[Outdated server components]

Thank you, this was the solution.

[Outdated server components]

Hello

 

ESET PROTECT (Server), Version 9.1 (9.1.1295.0)
ESET PROTECT (Web Console), Version 9.1 (9.1.292.0)

running on Windows Server 2016 Standard

Showing the following message:

Outdated Server Components

 

Third-party components used by the ESET PROTECT Server are outdated and should be updated as soon as possible.

Database serverMicrosoft SQL Server 2016 (SP Express Edition (64-bit) 13.0.6419.1

 

However this is the latest version:

 

https://support.microsoft.com/en-us/topic/kb3177312-sql-server-2016-build-versions-d6cd8e5f-4aa3-20ac-f38f-8faef950840f

 

What did I miss?

 

thanks,

Vilmos

[Server Security v9]

The version 9 is offered for us in ESMC, as an update.

hxxp://repository.eset.com/v1/com/eset/apps/business/efs/windows/v9/9.0.12012.0/efsw_nt64.msi.changelog.html

Quote

Version 9.0.12012.0

• New: Auto-update - opt-out automatic updates of product to the latest version
• New: Future End User License Agreement amendments and terms variation by notification
• New: Brute-force attack protection against password guessing for RDP and SMB services
• Improved: Auto-exclusion of MSSQL temporary database files in non-default location
• Improved: ESET OneDrive scanner deleted when permissions are not accepted
• Improved: Improved activation and interactive statuses of ESET Live Guard (EDTD)
• Fixed: Archived files restored after launching on-demand scan
• Fixed: Automatic exclusion of files when using a DC role with automatic exclusions enabled
• Fixed: Issues with reporting protection status to ESET Protect
• Fixed: Inconsistencies when using the GUI with high resolution screens
• Fixed: GUI does not start when using Terminal mode
• Fixed: Email notifications missing in ESHELL
• Fixed: Vulnerability CVE-2022-27167

Is there any reason for this is not advertised here in the forum, or here? https://help.eset.com/latestVersions/?lang=en

[How to trigger ESMC server upgrade?]

Hello

We are using Eset Protect (Server) Version 8.1 (8.1.1223.0).

A hotfix has been released 2 days ago (ESET PROTECT 8.1.13.1), but it hasn't popped up yet, no "Update product" menu item. The server already has been restarted some times.

How can we trigger this update notification?

thanks,
Vilmos

[Excessive malicious categorization]

I can confirm, we had the same issue. We are using Eset Endpoint Security 8.0.2028 Business. Web Control / Phish/Fraud category rule blocked some corporate and some public websites. Currently I cannot reproduce the issue.

["Pause firewall" permission]

by giving out the password (even if that password is different then the general one), the user will be able to change the other settings. The expected behavior would be that user able to pause only the firewall, and not be able to change any other setting.

["Pause firewall" permission]

Thanks for the reply. I'm sorry to hear that.

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

Description: "Pause Firewall" permission with policy

Detail: Client settings are locked down with password. The user ocassionally needs to disable/pause firewall, but we don't want to give out the password, just for this function. Also don't want to give to the user the possibility to change any other settings on the client. 

["Pause firewall" permission]

Hello

We have ESMC 7.2.1266.0 on the server and EES 7 on the Windows 10 client.
The user has local admin permission, but he only uses it as "run-as administrator". He doesn't log into the computer locally with the admin user.
The EES settings are locked down with password.
We would like to give a permission to the user: "Pause firewall", without giving out the password for the access setup.
Setting a different access setup password for that computer is not a solution, because by doing that he could change the other settings also.

How can we achieve this?

thanks,
Vilmos

ps. I opened this question in this topic, because it seems that it's policy related

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

here: ESMC, select policy (product: Eset File Security for Windows Server), 

Detection Engine, Processes Exclusions, Processes to be excluded from scanning

 

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

Description: ability to export folder exclusions from ESMC policy
Detail: to migrate exclusions from one policy to another

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

Description: ability to add process path containing environment variable:
Detail: in ESMC policy, add process exclusion
%systemroot%\System32\Vmms.exe   doesn't accept, "Invalid value"
c:\windows\System32\Vmms.exe    this works

+1: same value can be added multiple times

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

Description: change behaviour of adding new file/folder exclusions #4
Detail: in ESMC policy, adding folder exclusions
c:\test\*    works
c:\test*\*   doesn't work, "invalid path"

[Future changes to ESET PROTECT (formerly ESET Security Management Center / ESET Remote Administrator)]

Description: change behaviour of adding new file/folder exclusions #1
Detail: I need to exclude all *.mdb files in c:\test and all subfolders
Currently I can exclude *.mdb files only in the top folder (c:\test) but not in the subfolders

Description: change behaviour of adding new file/folder exclusions #2
Detail: I would like to exclude all *.vhdx files, but without specifying folder/drive (ESMC says when setting this in policy: "Invalid path")
If I type "\*.vhdx" into the field, I can save it, but if I scan a test file manually, the log file still shows: "Number of scanned objects: 1", so the exclusion doesn't work.

Description: change behaviour of adding new file/folder exclusions #3
Detail: if I import a txt file which contains correect and incorrect folder exclusion, ESMC says: "Not all input data have been imported".
And it imports the list partially, but doesn't show the not importable item(s). It would be nice, if ESMC show a message with the incorrect, not importable items.

 

[ERA Agent V7 issues]

I understand that this issue doesn't exist at you, which is good.

When I experienced this issue and restarted the service:

- the clients reported back to the server

- got the modified policy

- email notifications are sent out

Instantly.

Nothing changed, fw, configuration, etc. Only the service has been restarted.

This can be a bug in eset service or incompatibily between the OS and eset service. But I couldn't debug this, the debug log is not enough, or just don't understand some messages which could be relevant.

If I could help to solve this, I would be the happiest.

 

 

[ERA Agent V7 issues]

- here is no third party plugin

- also eraserver.exe process cpu utilization is ~50%, when the issue happens

- clients don't seem to able to connect to the server (not all, but almost all), last connected time is the same hour, minute, second

- clients don't get the modified policy on the servers, configuration tab shows "older" instead of actual (just a proof for the previous line)

- notification emails are stuck on the server, until the next service restart

Restarting the service solves all the above issues.

I have no doubt, that the problem is with the service.

[ERA Agent V7 issues]

Same here, waiting for fix. Scheduled service restart works as a workaround.