Re-import of whitelist entries fails with message "Aborted importing policies..."

Products

• Endpoint Detection and Response

Issue/Introduction

When re-importing whitelist entriesusing an export file from EDR 4.2 or 4.3, a dialog box containing the following message appears:

Import Policy

Aborted importing policies. No enum constant
com.symantec.atp.dataaccess.configuration.exclusions.atpobject.ExclusionBase,EXCLUSION_TARGET_TYPE.incidenttrigger.

Resolution

Please upgrade to EDR 4.4, where this issue is resolved.

If you are not in a position to upgrade in the near term, to workaround this issue, do one of the following:

• Remove all whitelist items with a "Type" of "Incident Trigger Sig ID" prior to exporting or;
• Remove any entries from the black/whitelist export file that have a "target_type" of "incident trigger"