I am currently running into an issue where I would like to scan the network from one server but when I try to scan a test machine the SEP Client is blocking the scan from occuring. I receive the alert "The client will block traffic from IP address 10.10.10.10 for the next 600 seconds"
Reviewing the logs in the SEPM I see this event under the Network Threat Protection as an "Active Response". Followed by several Intrusion Prevention alerts blocking specific Signature Names.
I tried going into the Intrusion Prevention policy and adding the Scanning Server into the Excluded Hosts list but that did not seem to work.
Is there any way to exclude the Scanning Server source and continue to protect the environment from scans from other sources?
Thanks,
Mike