Hi - I have an feature request for you guys.
It's regarding the Outbound Firewall and the way its currently managed to override currently blocked connections.
The way its being handled today if a user reports an issue where the Firewall currently blocks an connection that needs to be allowed, either you can change the endpoint to Unmanaged and do the bypass locally, or send the allow all processes blocked by the firewall command.
Both aren't really that user or admin friendy, the unmanaged option is time consuming for multiple endpoints and the allow all is not good from a security perspective.
So the feature request would be a better way to handle this. Something like an report to show all connections blocked by the firewall on an endpoint based level ( like Endpoints with undetermined software on last scan ) but Endpoints with firewall blocks on last scan, and where you can create overrides based on MD5 / application instead of everything currently blocked.
Best regards, Jonas Karlsson