cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 3

Changing alarm type from "internal event match" to "Field Match"

Current Version:   9.4.1  Build 20140924093413

I am attempting to change my alarms from an Internal Event Match to a Field Match.  This was suggested, as it will put the load on the receiver instead of the ESM.

The Internal Event Match uses:

Field: Signature ID

Value: 277-1033982

The Filed match I used:

Match component: Filter -> Signature ID (In)  [277-1033982]

I did force the alarm sync.

My original alarm will trigger everytime, but the field match will not trigger.  Any suggestions?

2 Replies
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 3

Re: Changing alarm type from "internal event match" to "Field Match"

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 3

Re: Changing alarm type from "internal event match" to "Field Match"

Hey Chris,

I do remember this was an issue when the feature was first released; so the link above may resolve your issue. In case you’re not to that step yet Try Disabling the original “internal event match” alarm this should let your “Field Match” alarm begin triggering.

R/

Jacob D

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community