Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 867594" data-attributes="member: 62850">Thank you for the suggestion Andy!&nbsp; We have something similar in place, but we could always modify or expand on the current implementation.Yes, in any version of VS that has WLC, the SS result is one of the heavily weighted features that determines the final WLC verdict.&nbsp; There are also around 20 or so digital signature features and 300 or so other features that all determine the final WLC result.&nbsp; The WLC result does not follow the SS result perfectly, but it is heavily influenced by the SS result, and is a little more aggressive than vanilla SS.&nbsp; From there, the user can choose how files that pass the WLC test are handled (please see screenshot).Having said that, I might have found a way to perform all of the analysis on the endpoint so that WLC no longer requires the file to be uploaded for analysis, although this is not really that big of a deal because each file only needs to be uploaded and analyzed once.&nbsp; Also it would require Windows 10, so we might wait until 10 has an even larger market share.[ATTACH=full]235226[/ATTACH]</blockquote>

[QUOTE="danb, post: 867594, member: 62850"] Thank you for the suggestion Andy! We have something similar in place, but we could always modify or expand on the current implementation. Yes, in any version of VS that has WLC, the SS result is one of the heavily weighted features that determines the final WLC verdict. There are also around 20 or so digital signature features and 300 or so other features that all determine the final WLC result. The WLC result does not follow the SS result perfectly, but it is heavily influenced by the SS result, and is a little more aggressive than vanilla SS. From there, the user can choose how files that pass the WLC test are handled (please see screenshot). Having said that, I might have found a way to perform all of the analysis on the endpoint so that WLC no longer requires the file to be uploaded for analysis, although this is not really that big of a deal because each file only needs to be uploaded and analyzed once. Also it would require Windows 10, so we might wait until 10 has an even larger market share. [ATTACH type="full"]235226[/ATTACH] [/QUOTE]

Verification