IPS / AMP Autocad file corruption

[Rob2041]

Does anyone know which specific IPS definitions would be corrupting AutoCAD or Revit files.  If we turn IPS off the corruption stops. If it is enabled some files get corrupted. Nothing shows up in the security center as blocks.

[RWelch]

Does anything show up if you try to Add an IDS rule to Allow list?

Security & SD-WAN > Configure > Threat Protection under Intrusion detection and prevention?

[Rob2041]

Nothing is in that dropdown, however we do have it in detection mode right now.

I wrote bypass rules based on IP addresses, but have not tested these out yet with prevention on. but was hoping to find out what rule is actually causing this issue, or if its the inspection itself.

[ww · Accepted solution]

In the sec center you can go to filter and select clean and unknown.

If there file is there you can copy the sha256 string and whitelist them in the allow list at the amp settings

[Rob2041]

Wow I've never actually looked at Clean and unknown.  This may be helpful in a bunch of different situations. I will check it out.