Complete list of event IDs for Host Intrusion Prevention 8.0
技術的な記事 ID:
KB65559
最終更新: 5/20/2021
環境
McAfee Host Intrusion Prevention (Host IPS) 8.0
概要
Every Host IPS client event sent to ePO has one of the following ePO event ID types:
Event ID
Description
Priority Scoring
18000
Host intrusion detected and handled
Depends on the triggered signature's assigned severity:
Disabled -> No event
Info -> Informational
Low -> Warning
Medium -> Minor
High -> Major
18001
Network intrusion detected and handled
Major
18002
Application blocked
<no ePO events>
18003
Failed Quarantine check (Trusted Source Block)
Informational
18006
Timed Group Enabled / Expired (see the second bullet in the following Notes)
Informational
18007
Policy Load Status
Policy corrupted -> Critical
Corruption Cleared -> Informational
18999
The IPS Event table is full. Further events are ignored until events are archived.
<Not generated by HIP Client>
NOTES:
There are no firewall blocking events sent back to ePO because of excessive bandwidth.
New functions were introduced in Host IPS 8.0 Patch 4. For more information, see "Reporting for timed groups usage" in the Host IPS 8.0 Patch 4 Release Notes This function is related to Network IPS Signature 6025 - Timed Group Enabled / Expired.
