You’re right, Joseph, you don’t want to go buy an expensive, flashy device like a Fireeye and then ignore it. I don’t have any insider knowledge, and can’t think of any good reason to disable that functionality, but can imagine two possible scenarios where someone would do it:

1. Someone high enough was nervous about automatically blocking something important and ordered the functionality that would have blocked the malware disabled.
2. They had it enabled, the alerts went off, and someone decided they were getting too many false positives, so that person (with or without supervisor approval–either sub-scenario is possible) disabled the functionality to make the false positives (whether they were real or imagined) go away.

At some points in my career, I may have argued against both forms of logic, in lower-stakes situations.

I’m impressed that Target had a Fireeye, or potentially more than one Fireeye. But it sounds like they weren’t using it to the extent that they could have. The Fireeye isn’t invincible, but the general consensus among my colleagues is that having one is much better than not having one, but, as this demonstrates, you need people who are able to configure it and correctly interpret its alerts, and you need processes to ensure proper, consistent configuration and use of the device. Just buying a bunch of flashy technology doesn’t stop bad things from happening.