Exa Quantum Filtering & ESET Endpoint Security

[Rawns]

So we've got a site with an internet connection with EXA with Quantum Filtering enabled (we're using AD integration & AD proxy). They've also moved from Kaspersky AV to ESET.

 

Since using ESET, the site have experienced issues with Quantum showing AD login boxes while browsing the internet. Exa have looked into it and say it's caused by ESET's web monitoring functionality and to resolve, we have to disable a number of key protection features in the AV policy:

 

- Application protocol content filtering

- Web Access protection

- HTTP and HTTPS Protocol checking

 

While this does seem to have a positive effect with the constant quantum AD logins, ESET is now throwing up critical warnings on all endpoints essentially saying you're not fully protected and your current config is very dangerous and the disabled options should be re-enabled immediately. These warnings cannot be suppressed wither so naturally the end users are concerned. The management console also shows the same when you log in.

 

We've got other sites on various ISP's (and some with Exa without Quantum) and running ESET without any issues, but only the one site with Exa's Quantum solution & ESET. It's not an issue elsewhere and leaving these options disabled in ESET makes me nervous. Has anyone else come across this issue? I can;t really decide if it's more of an Exa issue or an ESET one....

Edited September 19, 2018 by Rawns

[mavhc]

At a guess they both intercept TLS and use self signed CA certs. Quantum would probably use NTLM logon, so probably it's ESET not passing that through its local proxy system