Changing alarm type from "internal event match" to "Field Match"

[Former Member]

Current Version:   9.4.1  Build 20140924093413

I am attempting to change my alarms from an Internal Event Match to a Field Match.  This was suggested, as it will put the load on the receiver instead of the ESM.

The Internal Event Match uses:

Field: Signature ID

Value: 277-1033982

The Filed match I used:

Match component: Filter -> Signature ID (In)  [277-1033982]

I did force the alarm sync.

My original alarm will trigger everytime, but the field match will not trigger.  Any suggestions?

[Former Member]

Hi Chris,

I think you issue may have been addressed in 9.4.1 MR2

https://kc.mcafee.com/agent/index?page=content&id=KB79863&actp=null&viewlocale=en_US&showDraft=false...

[Former Member]

Hey Chris,

I do remember this was an issue when the feature was first released; so the link above may resolve your issue. In case you’re not to that step yet Try Disabling the original “internal event match” alarm this should let your “Field Match” alarm begin triggering.

R/

Jacob D