False malicious activities / windows update

st3213

Hi @Zyxel_Kevin,

unfortunately, the issue is still prevalent on our USG 500 flex. False positives still happen every month on MS patch day! It often involves some kind of dotnet-runtime-file, today it was the Update KB5023288. The Hash is 28F846B09CB2CFE30ADDFC2731853AF9.

You really should look at this - adding files to the allow list every month by hand or posting here is not a sustainable solution.

Thank you very much.

Vagabound

Here is the same procedure every month on Windows Patchday with a USG Flex 200. It is getting tedious to feed the white list every month.

Zyxel_Cooldia

HI @Vagabound,

Sorry for inconvenience caused. It is in our roadmap, and the solution would be ready at  the end of April.

Dexta

Vagabound said:

Here is the same procedure every month on Windows Patchday with a USG Flex 200. It is getting tedious to feed the white list every month.

At least you have a whitelist On Nebula you don't even have one. So we are stuck with installing by hand or disable the sandboxing feature.