Excessive Integrity Monitoring events with Trellix Agent 5.7 for Linux

Technical Articles ID: KB93974
Last Modified: 2024-01-17 12:51:34 Etc/GMT

Environment

Application and Change Control (ACC) for Linux 6.x
Trellix Agent (TA) 5.7.x for Linux

Problem

When you install or upgrade to TA 5.7 for Linux on ACC for Linux clients, the following process events trigger on the /etc/ma.d/EPOAGENT3000/config.xml file:

/opt/McAfee/agent/bin/masvc
masvc

You might see an excessive number of Integrity Control events for certain files and processes.

Solution

This issue is resolved in the ACC 8.3.3 Extension release.

Workaround

Create Filter rules to exclude the processes and files:

Log on to the ePO console.
Go to the Solidcore Rules menu.
In the Type filter section, select Integrity Monitoring.
Click Add Rule Group at the bottom of the page:
1. Provide a name for the Rule Group.
2. Set Type to Integrity Monitoring
3. Set Platform to Unix
Click OK.
Find the created Rule Group, and click Edit.
Switch to the Filters tab, and click Add Rule.
Set the criteria as specified below; see the "Exclusion rule criteria" section.
Click Save Rule Group.
Add the Rule Group to one of the Integrity Monitoring Rules (Unix) policies that are assigned to the ACC clients.
Edit the assigned Integrity Monitoring Rules (Unix) policy.
Click Add in the lower-left corner of the page.
Select the Rule Group that contains the new filter rule, and click OK.
Click Save.

Exclusion rule criteria:

Event equals File Attribute Modified
File equals /etc/ma.d/EPOAGENT3000/config.xml
Program equals /opt/McAfee/agent/bin/masvc

Event equals File Modified
File equals /etc/ma.d/EPOAGENT3000/config.xml
Program equals /opt/McAfee/agent/bin/masvc

Event equals File Attribute Modified
File equals /etc/ma.d/EPOAGENT3000/config.xml
Program equals masvc

Event equals File Modified
File equals /etc/ma.d/EPOAGENT3000/config.xml
Program equals masvc

You also might see events related to other files and processes, although the number of events might be much lower. Create a similar filter rule for these files or processes.

Other Trellix Agent file / process:
Event equals File Attribute Modified
File equals /etc/ma.d/CMNUPD__3000/config.xml
Program equals /opt/McAfee/agent/bin/Mue_InUse

Event equals File Modified
File equals /etc/ma.d/CMNUPD__3000/config.xml
Program equals /opt/McAfee/agent/bin/Mue_InUse

If the EDR for Linux client is installed:
Event equals File Attribute Modified
File equals /etc/ma.d/MVEDR___3000/config.xml
Program equals mfemvedr

Event equals File Modified
File equals /etc/ma.d/MVEDR___3000/config.xml
Program equals mfemvedr

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Excessive Integrity Monitoring events with Trellix Agent 5.7 for Linux

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Excessive Integrity Monitoring events with Trellix Agent 5.7 for Linux

Environment

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title