I exported all of my HIPS 8.0 policies which included 100+ custom signatures in the IPS Rule policy, when I try and re-import them the ePO server goes through the motions and appears to import OK however my IPS rule containing my custom created signatures doesn't show. If I edit the policy .xml file I can see the entries for the custom signatures but they point blank refuse to import.
The signatures and configurations were created on a test server with the plan of exporting them and importing them on to another identical ePO server. I know this has worked in the past and this may have been pre-patch 4, but to be honest I don't think I've tried it since our ePO servers were updated to patch 4, incidentally they are all running patch 4.
So as a test today I have gone in and exported all my HIPS 8.0 policies to a file, deleted the IPS Rules policy and tried to re-import the file again to the same server and the IPS Rules policy doesn't re-appear in the console
Any ideas on this one? If I have to re-create them all manually I'm going to be mightily pissed off! Not a day goes by without one of the McAfee products causing me grief!! :-)
Haven't dealt with HIPS that much but I'm wondering if it has to do with the exporting as one file vs exporting just the default policies and then exporting just the custom policies (two separate files). Reading through the product guide it does have one section for exporting default and another section for exporting custom...
Just a thought...