Manually set IPS exceptions in Endpoint Protection are automatically removed when the relevant IPS signatures are removed from the definitions

Products

• Endpoint Protection

Issue/Introduction

You configured Endpoint Protection IPS exceptions for specific IPS signatures but when these signatures are revoked from the defintions, the exceptions are removed automatically.

None.

Cause

This is by design. When new IPS defintions arrive on the SEPM the list of IPS exceptions is queried and when a referrenced IPS signature is removed, the related exceptions are automatically removed, too.

Environment

All Endpoint Protection releases with manually added IPS exceptions.

Resolution

You need to monitor the IPS signatures for changes as the Updated IPS policy with the amended exceptions might be disrtibuted before the new content is deliverd to the clients.