4 Replies Latest reply on Apr 11, 2013 12:32 PM by JoeBidgood

    [ePo 5.0] Threat events apparently gets send to server but no trace of them on Threat Event Log

    kkspike

      Hi, this is my setup (clean install of ePo server (not an upgrade, this is a new installation altogether)

       

      ePO Build: ePolicy Orchestrator 5.0.0 (Build: 1160)

       

      McAfee Agent 4.8.0.641

      McAfee Viruscan Entreprise 8.8.0(1128)

       

      I installed ePo 5.0 on a Windows 2012 server and installed the Agent on a couple of workstations to get things going. I wanted to see how reporting works so I triggered a threat event on my workstation with Eicar. I got the alert on screen and I went to the server only to see that it didn't show on it. So I read a bit about the process of a threat detection event locally all trough the way to the server.

       

      I can see events building in the C:\ProgramData\McAfee\Common Framework\AgentEvents directory. If I manually send them trough the Agent Monitor, they apparently get processed and deleted from the directory. However, when I go to he ePo server's Threat Event Log, I don't see anything there.

       

      Am I missing something? Do I need a special extension to process the threat events?

       

      [edit] I will add that I checked the 'Event Filtering' option under 'Server Configuration' on the ePo server and everything seemed checked and ok.

       

      Message was edited by: kkspike on 11/04/13 10:39:08 CDT AM