How to troubleshoot Device Control and Firewall issues

[Ufoto 14]

Hello All,

I just wanted to ask - is there an efficient way to troubleshoot Device Control and Firewall-related issue from the central console (in this case ESET Protect Cloud)? Although traffic is being blocked by the firewall we can't see any events in the console, and devices being blocked by Device Control are visible only locally. We created reports for Device Control and Firewall incidents, and although some firewall events are visible, they are only a fraction of the connections that are not working when Firewall is enabled. The firewall is set to Automatic Mode, and 'Also evaluate rules from Windows Firewall' is enabled.

If this is not available in the console, is there a Firewall Activity log file locally on the endpoints?

Thank you in advance!

[Ufoto 14]

I think I've made some progress, I assigned the enhanced logging policy to some test devices, and I enabled Diagnostic Logs on some of the test machines and the blocked events started to appear. Is this the best way of doing it?

[thae 9]

On 3/25/2022 at 4:13 PM, Ufoto said:

I think I've made some progress, I assigned the enhanced logging policy to some test devices, and I enabled Diagnostic Logs on some of the test machines and the blocked events started to appear. Is this the best way of doing it?

From what I have read and tested, the only possibility to get device control events on the server is to activate diagnostic logs.
But this gets disabled after the device reboots and the device gets marked with a warning because diagnostic logs are enabled.

A really useful feature would be that users can send an automatic e-mail, when the blocked device screen pops up. I've already requested that feature in the Future Changes.