maxsteel12 wrote:
The Firewall rule which you need to monitor for a specific or multiple system.
Just Duplicate the assigned IPS rule give it a new name & type the IPS Signature 3702 and make sure its severity is set to high.
Go back to Firewall policy assigned to machine or group of the machine and check the box "Treat matched traffic as Intrusion" Save the firewall rule and assign to machine where you want to monitor Firewall logs from ePO.
Send a wake up agent and you will be able to see the firewall logs on ePO console.
**Note: This is not recommended because that can fill the DB by Firewall logs USE this only for troubleshooting purpose & that will cut the dependency of collect activity log from the machine**
This is not firewall event monitoring. Triggering Signature 3702 is generating Network IPS events that do contain some bits of detail (like IP, protocol, ports, directory, etc.) involved, but they are not Firewall events (no details about which FW triggered the intrusion, app names, etc.). HIPS 8.0 cannot generate Firewall events back to the ePO server; use ENS 10.x if you wish to have true firewall event logging (in ENS, use the LOG MATCHING TRAFFIC per FW rule to send ePO events back to ePO).
