[ES] Using the security administrator account to handle threat prompts no permission
Problem Description
The ES security administrator account is used to respond to threats in the response center, but it prompts that there is no permission.
Alarm Information
Effective Troubleshooting Steps
- Confirm whether the threat being addressed is a zombie network or an advanced threat.
- Confirm whether there are corresponding error messages for handling other threats besides handling these two types of threats.
- Confirm if the version of ES is lower than 3.5.20.
Root Cause
The security administrator of ES is unable to deal with botnets and advanced threats, which is a mechanism problem.
3.5.20 optimized the ability to deal with zombie networks, but advanced threats have not been optimized yet.
Solution
Mechanism problem, explain to the customer.
Scope of Operation Impact
None
Original Link
https://support.sangfor.com.cn/cases/list?product_id=16&type=1&category_id=2706&isOpen=true