AnsweredAssumed Answered

What does QID 105294 look for ? getting FPs

Question asked by Michael Scheidell on Aug 30, 2018
Latest reply on Sep 5, 2018 by DMFezzaReed

I am getting almost 'random' FPs when checking for anti-virus, all Windows Server 2012 R2 Standard 64 bit Edition.

this last run, 20 servers are incorrectly marked as missinb AV.

I checked 4 servers, 2 QUALYS said had av, two qualys said didn't.

I can't see the correlation.

 

MS threatcenter says its all ok.

 

Running Carbon Black 'Cb Defense' .(and as I said, MS threat center says its all ok)

 

its NOT a DAT file (CB Defense doesn't do dat)

Its NOT the version (same version is marked 'no av' on one server, 'has av' on another)

Cb Defense is NOT in 'monitor only' mode, and ALL 20 servers have same profile on them.

Outcomes