cancel
Showing results for 
Search instead for 
Did you mean: 

Request for KB to fully explain ENS Firewall Logging in Detail (w/ scenarios)

Jump to solution

Related Options in ePO:

ePO Policy > Endpoint Security Firewall: Firewall

☐ Treat match as intrusion
☐ Log matching traffic

ePO Server Settings > Event Filtering

☑ 35000: Traffic allowed by Firewall (Info)
☑ 35001: Firewall intrusion detected and handled (Info

Questions I've asked support about, multiple times, and I cannot seem to get a clear or consistent answer:

  1. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger Event ID 35000 in ePO?

  2. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log?

  3. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger Event ID 35001?

  4. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log?

  5. If both "Log matching traffic" and "Treat match as intrusion" checkboxes are enabled, are two events created in ePO for the same rule when triggered?

  6. Is there any way to log events only in local ENS UI Event Log (like HIPS used to do natively) and not send an event to ePO?

  7. If "Log matching traffic" is enabled in a firewall rule and the rule is set to "Block," does that trigger Event ID 35000 in ePO?  If so, this is misleading because  the event description is "Traffic Allowed by Firewall."
1 Solution

Accepted Solutions
Highlighted
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: Request for KB to fully explain ENS Firewall Logging in Detail (w/ scenarios)

Jump to solution

Hi @securitasis, from my testing with ENSFW 10.6.1 July Update:

 

Questions I've asked support about, multiple times, and I cannot seem to get a clear or consistent answer:

  1. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger Event ID 35000 in ePO? {KT} Event ID 35000 (allow) or 35002 (blocked) will be triggered. ENS Event IDs are listed in KB85494.  Also review a known issue in KB90177 with "Log matching traffic" on generic allow/block Firewall rules.


    35000 event_name_35000=Traffic allowed by Firewall
    event_desc_35000=Traffic allowed by Firewall
    Firewall
    35001 event_name_35001=Firewall intrusion detected and handled
    event_desc_35001=Firewall intrusion detected and handled
    Firewall
    35002 event_name_35002=Traffic blocked by Firewall
    event_desc_35002=Traffic blocked by Firewall
    Firewall
    35003 event_name_35003=Firewall added adaptive rule
    event_desc_35003=Firewall added adaptive rule
    Firewall
    35009 event_name_35009=Firewall is disabled from Mctray
    event_desc_35009=Firewall is disabled from Mctray
    Firewall
    35010 event_name_35010=Firewall timed groups are enabled from McTray
    event_desc_35010=Firewall timed groups are enabled from McTray
    Firewall
    35011 event_name_35011=Firewall policy was corrupt and has been repaired
    event_desc_35011=Firewall policy was corrupt and has been repaired
    Firewall
    35012 event_name_35012=Firewall policy has been replaced with a new copy
    event_desc_35012=Firewall policy has been replaced with a new copy
    Firewall








  2. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log? {KT} Yes.  "Log matching traffic" triggers an ePO event, which shows in the ENS Console as Threat Category = Traffic detected.

  3. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger Event ID 35001? {KT} Yes; event will show in ENS Console as Threat Category = Intrusion Detected, which is Event ID 35001

  4. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log? {KT} Yes; event will show in ENS Console as Threat Category = Intrusion Detected.

  5. If both "Log matching traffic" and "Treat match as intrusion" checkboxes are enabled, are two events created in ePO for the same rule when triggered? {KT} No, the "Treat match as intrusion" event overrides the "Log matching traffic" option.

  6. Is there any way to log events only in local ENS UI Event Log (like HIPS used to do natively) and not send an event to ePO? {KT} No, this is how ENS Firewall logging is designed as a difference from HIPS 8.0 Firewall.  The design is intended to review the FirewallEventMonitor.log file for allow/blocked network traffic rule matches. With HIPS 8.0 FW, the Firewall activity was written to the console because the raw event.log file was not really human readable, and had to be specifically exported (with the EXPORT button) from within the HIPS ClientUI (or converted with ClientControl.exe) to get a human readable file format (like what ENSFW has today). 

  7. If "Log matching traffic" is enabled in a firewall rule and the rule is set to "Block," does that trigger Event ID 35000 in ePO?  If so, this is misleading because  the event description is "Traffic Allowed by Firewall." {KT} As above, "Log matching traffic" on a BLOCK rule is Event ID 35002.  If you are seeing this issue, please report it to McAfee Support with debug data; ref KB90662.

 

 

Also, if you would like to request changes to how ENS Firewall logging works, please submit a PER for review; ref KB60021.

3 Replies
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Request for KB for to fully explain ENS Firewall Logging in Detail (w/ scenarios)

Jump to solution

You can find this info in the product guide:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27580/en_US/...

• Treat match as intrusion — Treats traffic that matches the McAfee GTI block threshold setting as an
intrusion and displays an alert.

• Log matching traffic — Treats traffic that matches the McAfee GTI block threshold setting as a detection
and displays an event in the Event Log on the Endpoint Security Client. Firewall also sends an event to
McAfee ePO.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Highlighted
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: Request for KB to fully explain ENS Firewall Logging in Detail (w/ scenarios)

Jump to solution

Hi @securitasis, from my testing with ENSFW 10.6.1 July Update:

 

Questions I've asked support about, multiple times, and I cannot seem to get a clear or consistent answer:

  1. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger Event ID 35000 in ePO? {KT} Event ID 35000 (allow) or 35002 (blocked) will be triggered. ENS Event IDs are listed in KB85494.  Also review a known issue in KB90177 with "Log matching traffic" on generic allow/block Firewall rules.


    35000 event_name_35000=Traffic allowed by Firewall
    event_desc_35000=Traffic allowed by Firewall
    Firewall
    35001 event_name_35001=Firewall intrusion detected and handled
    event_desc_35001=Firewall intrusion detected and handled
    Firewall
    35002 event_name_35002=Traffic blocked by Firewall
    event_desc_35002=Traffic blocked by Firewall
    Firewall
    35003 event_name_35003=Firewall added adaptive rule
    event_desc_35003=Firewall added adaptive rule
    Firewall
    35009 event_name_35009=Firewall is disabled from Mctray
    event_desc_35009=Firewall is disabled from Mctray
    Firewall
    35010 event_name_35010=Firewall timed groups are enabled from McTray
    event_desc_35010=Firewall timed groups are enabled from McTray
    Firewall
    35011 event_name_35011=Firewall policy was corrupt and has been repaired
    event_desc_35011=Firewall policy was corrupt and has been repaired
    Firewall
    35012 event_name_35012=Firewall policy has been replaced with a new copy
    event_desc_35012=Firewall policy has been replaced with a new copy
    Firewall








  2. Does enabling "Log matching traffic" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log? {KT} Yes.  "Log matching traffic" triggers an ePO event, which shows in the ENS Console as Threat Category = Traffic detected.

  3. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger Event ID 35001? {KT} Yes; event will show in ENS Console as Threat Category = Intrusion Detected, which is Event ID 35001

  4. Does enabling "Treat match as intrusion" checkbox inside a ENS firewall rule trigger an event in the ENS UI Event Log? {KT} Yes; event will show in ENS Console as Threat Category = Intrusion Detected.

  5. If both "Log matching traffic" and "Treat match as intrusion" checkboxes are enabled, are two events created in ePO for the same rule when triggered? {KT} No, the "Treat match as intrusion" event overrides the "Log matching traffic" option.

  6. Is there any way to log events only in local ENS UI Event Log (like HIPS used to do natively) and not send an event to ePO? {KT} No, this is how ENS Firewall logging is designed as a difference from HIPS 8.0 Firewall.  The design is intended to review the FirewallEventMonitor.log file for allow/blocked network traffic rule matches. With HIPS 8.0 FW, the Firewall activity was written to the console because the raw event.log file was not really human readable, and had to be specifically exported (with the EXPORT button) from within the HIPS ClientUI (or converted with ClientControl.exe) to get a human readable file format (like what ENSFW has today). 

  7. If "Log matching traffic" is enabled in a firewall rule and the rule is set to "Block," does that trigger Event ID 35000 in ePO?  If so, this is misleading because  the event description is "Traffic Allowed by Firewall." {KT} As above, "Log matching traffic" on a BLOCK rule is Event ID 35002.  If you are seeing this issue, please report it to McAfee Support with debug data; ref KB90662.

 

 

Also, if you would like to request changes to how ENS Firewall logging works, please submit a PER for review; ref KB60021.

Re: Request for KB to fully explain ENS Firewall Logging in Detail (w/ scenarios)

Jump to solution
Thank you, Kary. Long time no see/chat. You are the best!
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community