I was able to pull this from firesvc.log. Anyone happen to know if it's related?
01/31/2013 11:07:29 CLmisc.cpp ERROR (6264) PGPclGetServiceStatusByName() - failed to open SCM (1115).
01/31/2013 11:10:26 MAINWRK ERROR (2548) forcePolicyEnforcement() - Failed waiting for new policy check to finish.
01/31/2013 11:11:33 ENTCPWRK ERROR Clear boot time access protection, no action taken.
01/31/2013 11:12:48 wsc.cpp ERROR Failed to register the firewall with the Vista SP1 or later WSC (8000000a).
Don't use Adaptive mode with IPS. You really do NOT want to create exceptions. If you really want to see what it is going to do then change Prevent to Log. Start with High and then move onto Medium.
Low severity isn't really what you want. Pretty much no one uses that content. Though occasionally you might promote one to medium.
I found this on this community: https://community.mcafee.com/message/212795
Thank Mr Kary Tankink
Create a file with a double extension <filename>.com.exe
If you have Host IPS IPS Protection policy is set to HIGH: PREVENT, and Signature 413 is set to HIGH Severity, then executing a filename with <filename>.com.exe will trigger this signature.
I use this all the time (on Win7 64-bit) to trigger violations by executing notepad.com.exe or putty.com.exe, etc. for testing purposes.
I would not put your stuff into adaptive. I would probably log all, and look for blocks and do what you please with them.
Furthermore, for the 413 IPS Signature, we have found the McAfee signature to be pretty bad at detecting double file extensions. We created a custom and it pretty much catches everything.
This is one of the methods I tried, but thank you. I was unable to find a solution and opened a ticket with McAfee. I'm no longer overseeing the systems, however, so will not know how this was resolved. One problem we were having was the Event Parser service not starting, though that would seem to be unrelated to the event not triggering on the endpoint.