The current HIPS 8.0 version does not have functionality to log firewall events to ePO. You will have to go local to the system and review the HIPS Activity log (in the HIPS ClientU - McAfeeFire.exe) for blocked/allowed Firewall events. Please submit a PER if you'd like to request this functionality in a future version.
KB60021 - Information about Product Enhancement Requests for McAfee products
Workaround is Using TAT see below doc.
ok thanks...that explains the Firewall however I am not getting IPS events....Any thought on those?
Can you check the following
"D:\Program Files\Mcafee\Epolicy orchestrator\DB\Logs\EventParser.log" do you see this entry ?
Server_ProcessXMLFile: Failed to create parser extension for <HostIPS8>