Security

Reply
Occasional Contributor II

Endpoint not updated with the audit results

I am having a hard time making the Audit option (in a service) in 6.7 working.  

The scenraio is an IOT device connecting and then profiled. Based on the NMAP profiling results the cocnnection remains or being terminated. 

Service is configured with Local Endpoint repository as an Authorization source.

Profiler and Audit are defined in the service. 

the problem: nmap is running, and I can see the results in the access tracker (Audit Success). But the the Endpoint is not updated 

Anybody knows what are the conditions to update the endpoint record?

BTW when a I do an on demand scan the endpoint record is updated fine. 

 

1.JPG2.JPG

 

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: