ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
Duplicate events appear for EICAR detections
Article ID: 162049
Endpoint Detection and Response
Duplicate events appear for EICAR detections.
Some browsers (Chrome and Firefox, for example) automatically retry a connection to a website if they encounter a failure. When a browser retries connections, websites that are blocked by the ATP: Network appliance, or by an endpoint security product such as Symantec Endpoint Protection Manager, may show up as 2 convictions that occur simultaneously on the same endpoint. This is because the appliance detects two distinct attempts to go to the blocked site.