jbennin

Update - doing some digging on the client, I was able to delete a .JSON file that was located in the ArwDetections path shown below. This stopped the continuous notifications from occuring. What would have caused this?

Below is a screenshot of one of the messages

We had a confirmed false positive against a client that we've since EXCLUDED and repaired the known safe application. We also weren't receiving NOTIFICATIONS from the Anti-ransomware module and upon restoral, we seem to be getting a large backlog of notices on the event from 1 day ago. Every notice has a varying number of notices which all have the same TIME | HOSTNAME | IP ADDRESS etc... Is their a backed up queue we can clear in order to get rid of this situation and resume receiving legitimate notices for the module? Any assistance is greatly appreciated. Server reboot was already done.