Signature 1001 and 1002 are IPS signatures. Triggering those will send an event back to the ePO server. I believe Eric wanted the blocked firewall packets that show up in the local UI to be sent back to the ePO server. As Joe pointed out, that's not possible. If HIP was to send every blocked packet that was logged, the ePO server would be overwhelmed in five minutes.
Here's what I want: I want to deploy HIPS to tens or hundreds of computer, with firewall used to block networking to all applications but the ones I list. So I added for example FIREFOX.EXE and IEXPLORE.EXE and allow these to communicate on ports 80 and 443. But when someone installs Safari as a browser, it won't communicate. I would like that to show up on my ePO server, that SAFARI.EXE is trying to communicate over port 80.