Exploit Prevention Events - not showing all events

[jkbharrison]

Hello,

I have several systems generating EP events, but they are not displaying under Reporting --> Exploit Prevention Events. The last event to be reported was 05/30/18, but events on the client are being generated every day since. Any ideas?

[denn]

Have you tried to reinstall McAfee agent ? I have same issue, Agent communicating with ePO, receiving tasks but not reporting any events to ePO, After Agent reinstall issue was resolved.

[jkbharrison]

Reinstalling the agent doesn't resolve the issue. Clients are sending events to ePO successfully, but Menu --> Exploit Prevention Events does not show any of the events after 5/30. If I create a manual query I can view all EP events. Furthermore, I receive an error when attempting to open any event currently under Menu --> Exploit Prevention Events. 

[kamranshakil77]

Did you validate if all events are being sent back to EPO. This can be done manually on the endpoint.


Also are you using default settings which only gather 'HIGH' mcafee-defined messages. There are stilll a plethora of messages classfied as 'LOW' and 'MEDIUM' which are not ticked/checked by default. Please take a look there in the configuration section and check the endpoint message uploads again from endpoint to the EPO.

[andy_judge]

The issue is the events are appearing under the Threat Events section of the machine record in ePO just not appearing in the 'Exploit Prevention Events' section in the console.

So the events are reported in ePO & present in the DB somewhere, just not in the area that makes the creation of new exclusions simple.