Keep receiving Proactive Defense events though it is disabled

Issue

Keep receiving Proactive Defense events in the Imunify Dashboard even though the mode is set to 'Disabled'.

Environment

• Any environment supported for Imunify360
• Proactive Defense

Solution

1. Set the user_override_proactive_defense parameter to the False in the config file to stop receiving new Proactive Defense events.

imunify360-agent config update '{"PERMISSIONS": {"user_override_proactive_defense": false}}'

Cause

Proactive Defense may be indeed disabled by the administrator:

PROACTIVE_DEFENCE:
  blamer: false
  mode: DISABLED
  php_immunity: false

However, it can be enabled on a user level and the permissions are set to override the configuration set by the administrator:

PERMISSIONS:
  user_override_proactive_defense: true

From the config description:

user_override_proactive_defense: False

# "True" allows overriding of Proactive Defense work mode by a regular user. E.g., users will be able to switch Proactive Defense mode to LOG for their websites even if the admin has set it to KILL.

Useful links

https://docs.imunify360.com/config_file_description/#config-file-description