This table contains common Cynic errors and possible solutions.
Error or Symptom |
Solution |
|
Please review your SEPM Controller settings and verify that no passwords, hostnames or IPs have changed. See: 'Get a File' requests from Advanced Threat Protection fail |
Central manager logs contain errors around deserialization of a get_file_for_cynic command |
Please update to SEDR 4.1.0, which contains a fix for this issue. |
UI Logging shows submit_to_sandbox command does not progress past status code "3: Started " |
Please update from ATP 3.x to SEDR 4.0.0 or later. If you are not able to upgrade immediately, please contact support to confirm and work around this issue. See: UI Logging shows submit_to_sandbox command does not progress past status code "3: Started" |
|
Please upgrade to Symantec Endpoint Detection and Response 4.0.0 or later. See: Targeted Attack Analytics service failed to get Cynic credentials |
Error: Cynic query failed |
This issue can be resolved by reinstalling the ATP license to the ATP Manager. Changing the Cynic Sandboxing to "Use United Kingdom regional instance only", then un-selecting it also works. See: Cynic file submission failed |
ERROR_REQUEST_TIMEOUT |
Verify firewall/proxy are allowing traffic, for more information See: Required firewall ports |
Cannot Manually Submit Files to Cynic - Portal Reports License as Invalid |
The current workaround is to create a new user with a different email address to log into the Cynic portal. Do not use an existing MSS or DeepSight account to access the service. See: Cannot Manually Submit Files to Cynic - Portal Reports License as Invalid |
Error: File size of "size" is over limit |
Currently it is not possible to submit files to Cynic that are larger than 10MB. |
When submitting files to Cynic from the Advanced Threat Protection appliance, you receive different results if the file is slightly changed to alter the hash |
Due to unpredictability of live malware, there is no guarantee of consistent behavior. Many viruses, trojans and worms attempt various actions based on a number of different criteria. The main focus should be whether the malicious verdict of the file is accurate or not. If you suspect a False Positive or Missed Detection from Cynic, please review this KB document for submitting the file to Symantec Security Response for analysis See: When submitting files to Cynic from the Advanced Threat Protection appliance, you receive different results if the file is slightly changed to alter the hash |