Hi everyone, I’m pretty new to enterprise security tools and we’ve been trialing Vision One for a few weeks. Overall, it seems powerful, but I’m running into a frustrating issue that’s blocking our development workflow.
Our CI/CD pipeline (we use Jenkins) builds and pushes applications, and recently Vision One keeps quarantining some of the intermediate files and even a few final build artifacts. It flags them as suspicious. This causes the pipeline to fail because files it expects are suddenly gone. I have to go into the console and restore them each time, which isn’t sustainable.
I’m not a security expert, so I feel a bit lost. The files are from legitimate build steps (like compiled modules or packaged containers). I’ve looked at the policy settings, but there are so many modules and options—XDR, sandbox analysis, etc.—that I’m overwhelmed. I don’t want to just disable protection for that server, but I need these automated builds to run without interruption.
Has anyone else dealt with this? Is there a specific policy or exclusion setting I should be looking at for CI/CD servers? Maybe a way to tag that system so it’s treated differently? Any guidance would be so appreciated. I’m worried about rolling this out more broadly if it’s going to stop our developers from doing their work.
✌️ annie
I've been down this exact rabbit hole with Vision One and Jenkins. The "so many modules and options" bit is real - it's like they threw every security feature at the wall and called it a day.
What worked for me was creating a **policy exception** specifically for the build server's file paths. Under the "Endpoint Security" module (or maybe it's called "Endpoint Protection" in your version), there's an exclusion list where you can add directory patterns. I added something like `/var/lib/jenkins/workspace/*` and `*/build/*` - but you have to be careful not to exclude the whole server, just the temp/artifact folders.
Also, try tagging the Jenkins host in the console as "BuildServer" or "CI" and then create a policy that says "for this tag, apply a lighter detection profile" - there's a profile option called "Low False Positive" or something similar. It's not disabling protection, it's just telling the engine to be less aggressive on known build artifacts.
One thing that tripped me up: sandbox analysis can trigger on files that are being written and then read quickly - the script that builds the artifact might get flagged as behavior. I had to whitelist the Jenkins agent process itself in the "Application Control" module.
Don't just disable everything. You'll miss the real threats. But a well-tuned exclusion for your pipeline's specific temp directories? That's the sweet spot. Have you checked if the quarantined files have a specific pattern in the threat name, like "Suspicious_Compiled" or something?
Try everything, keep what works.