Excluded threats/detections keep returning as Unresolved

[j-gray 37]

Typically I'll go to the 'Detections' area of the dashboard and will see a bunch of alerts for unresolved threats and detections that I've already excluded. I then open up the specific exclusion and click the 'Update Exclusion' button without making any changes. This will then resolve the new alerts. I have to do this every day or so for multiple exclusions.

To be clear, I am not editing the exclusions at all. I'm simply opening them, and clicking 'Update Exclusion' so that it then goes through and resolves the detected issues.

We rolled this out in early November and three months later, we're still struggling to get it functional.

[Peter Randziak 1,163]

On 2/8/2022 at 6:56 PM, j-gray said:

will see a bunch of alerts for unresolved threats and detections that I've already excluded

Hello @j-gray,

This looks like the issue mentioned at https://forum.eset.com/topic/31146-eei-false-positive-on-every-7zip-action-and-cant-be-turned-into-an-exception/

 

Just yesterday we released EEI 1.6.1766.0 and one of the changelog entries is "Fixed: EEI exclusions for new detections", so an upgrade might resolve the issue...

Peter

[j-gray 37]

Just to confirm, 1.6.1766.0 seems to have resolved our issue with exclusions being ignored.

Thanks for the heads-up.