cancel
Showing results for 
Search instead for 
Did you mean: 
yoann63
Level 7

import HIP rules on EPO

hi,

i meet some problems with one rule in HIP module of EPO.

I create my rule: all protocols/both sides/ activated/one file allowed (**\myfile.exe)

I see the rule in every agents but the rule doesn't work.

So i made the rule directly on the agent with "learn mode"... It works

When i compare the two rules i don't see any differences.

So my question is:

Is there a possibility to export rule from the agent to the EPO ?

Thanks for your help...

Y

0 Kudos
3 Replies
McAfee Employee

Re: import HIP rules on EPO

Is there a possibility to export rule from the agent to the EPO ?

There is no specific export/import functionality between the Agent and ePO, however, any local HIPS client rules will be sent to the ePO server for you to add to the policy.

KB58949 - Host Intrusion Prevention client rules do not display in the ePO 4.x console

PD22894 - Host Intrusion Prevention 8.0 for ePO 4.5 ProductGuide  (page 63; Learn/Adaptive mode client rules)

Message was edited by: ktankink on 6/12/13 3:19:09 PM CDT
0 Kudos

Re: import HIP rules on EPO

Please find the attachement for HIPS signature list, there is no way to export the signature list from epo.

Thanks

Yogesh

0 Kudos
McAfee Employee

Re: import HIP rules on EPO

You can export HIPS signatures to a spreadsheet via a SQL query.

See:

KB55119 - Host Intrusion Prevention Content Signature Query in ePO 4.x

https://kc.mcafee.com/corporate/index?page=content&id=KB55119

0 Kudos