Access Protection events aren't available in ePO

Technical Articles ID: KB87149
Last Modified: 2022-01-25 14:34:33 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention 10.x
ePolicy Orchestrator (ePO) 5.x

Problem

Access Protection events aren't available in ePO, even though the events are logged locally and confirmed to be occurring on the client system.

Cause

The default configuration of the ENS policy for event generation and the McAfee Agent configuration for Event Filtering might be suppressing or excluding Access Protection events, so they never reach the ePO server. In this case:

The Endpoint Security Common policy is configured not to send events that are Informational.
The McAfee Agent Event Filtering policy configured in the ePO Server Settings excludes sending Event ID 1092 and 1095.

Solution 1

To send all events, modify the Endpoint Security Common policy:

Log on to the ePO console.
Navigate to Policy Catalog, Endpoint Security Common, the assigned policy, Show Advanced.
In the Event Logging section, change the drop-down list for Access Protection events to log All events.

NOTE: Event Logging must be set to All because the Access Protection events generated by the clients are Informational from the perspective of the ePO server, despite being Critical events from the perspective of the client.

Solution 2

To send Event IDs 1092 and 1095, modify the McAfee Agent configuration for Event Filtering:

Log on to the ePO console.
Navigate to Menu, Server Settings, Event Filtering.
Click Edit.
Locate the Event ID for which you want to receive events and make sure that it's selected:
- 1092: Access protection rule violation detected and blocked (Low)
- 1095: Access Protection rule violation detected and NOT blocked (Low)
Event ID 1092 is for Access Protection rules that are configured to Block and report. Event ID 1095 is for Access Protection rules that are configured to Report only.
Click Save.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Access Protection events aren't available in ePO

Environment

Problem

Cause

Solution 1

Solution 2

Affected Products

Languages:

Title

Title

Knowledge Center

Access Protection events aren't available in ePO

Environment

Problem

Cause

Solution 1

Solution 2

Affected Products

Languages:

Choose your region

Title

Title