have u solve this? i think the EDR turn off the firewall is temporary , maybe it is updating or scanning.

it indicate that it detects a malware.

However, an EDR solution may detect that a firewall is interfering with network access or other system functions in some cases.

A recent software update or system configuration change could have caused the EDR agent and firewall to stop working correctly. Sometimes updates or changes to your system can inadvertently cause conflicts with security software and result in malfunctions.

In some cases, however, an EDR solution may detect that a firewall is causing issues with network connectivity or other system functions. In such cases, the EDR solution may recommend disabling the firewall temporarily to troubleshoot the issue. However, this would typically be done with the explicit knowledge and consent of the system administrator or other responsible parties, and only as a temporary measure until the issue can be resolved.

Get help with technical support

The command mentioned, "netsh advfirewall set allprofiles state off," is used to disable the Windows Firewall for all network profiles (Domain, Private, and Public). It turns off the firewall protection, allowing all incoming and outgoing network traffic without any filtering or blocking.

However, it's important to note that disabling the Windows Firewall can expose your computer or network to potential security risks. The firewall acts as a barrier between your system and the outside network, helping to prevent unauthorized access and protecting against malicious threats.

If you choose to disable the firewall temporarily for troubleshooting purposes or other specific reasons, make sure to take appropriate precautions, such as ensuring that your computer is not directly connected to the internet or being used in an insecure network environment.

After you have completed your intended tasks, it is strongly recommended to enable the Windows Firewall or configure it to allow only necessary traffic based on your network security requirements. You can enable the firewall again using the command:

netsh advfirewall set allprofiles state on


Always prioritize the security of your system and network by implementing a comprehensive and robust security strategy.

Please contact technical assistance.

The presence of red dots on the EDR agent symbol might indicate that the EDR agent is malfunctioning or that it is not interacting correctly with the security dashboard or server.

You may need to analyze the logs and alarms from your SIEM and EDR systems, as well as any other security software installed on the impacted endpoint, to investigate this issue.