cancel
Showing results for 
Search instead for 
Did you mean: 
Jmac24
Level 11
Report Inappropriate Content
Message 1 of 3

Exploit Prevention Queries and Alerts on Specific Rules

I've been driving myself crazy for a while trying to build a query or automated response when a specific EP rule is violated and action is taken. There are 2 in particular and I have no been able to find a way to filter them down for them. 

Lets say I only want to query on or have a response if rule ID 6109 - Powershell - Suspocious wmi script execution is violated. I don't see a way to filter for Analyzer Rule ID or Analyzer rule name. Is there a way to do this?

Thanks

2 Replies
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Exploit Prevention Queries and Alerts on Specific Rules

Hi @Jmac24,

Firstly, Good Post and Question. I am afraid my answer will not make you happy

The maximum you can get in terms of granularity is that you can pick Threat Name ExP:Illegal API Use for the powershell based Exploit Prevention Events. However, This will club all illegal API use events! This is restricted in Automatic Responses.

As you can see the Exploit Prevention Signature rules do not have a separate Event ID by themselves! Hence The Signatures Rule IDs are registered by the endpoint and sent to ePO in the form of Analyzer Rule ID.

I am afraid this would mean that you may have to raise a PER - product Enhancement Request with us.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Exploit Prevention Queries and Alerts on Specific Rules

Hi @Jmac24 

Having said the above, If you are okay with a daily report of these events instead of automatic responses, You may work around this using Reports/Queries. You can pull a Threat Report and Use Filters to filter out the "Analyzer Rule IDs" you require. Then, You can schedule the report on a daily manner or a higher frequency to your email address with only these events being reported.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community