Every Host IPS client event sent to ePO has one of the following ePO event ID types:
Event ID
Description
Priority Scoring
18000
Host intrusion detected and handled
Depends on the triggered signature's assigned severity:
Disabled -> No event
Info -> Informational
Low -> Warning
Medium -> Minor
High -> Major
18001
Network intrusion detected and handled
Major
18002
Application blocked
<no ePO events>
18003
Failed Quarantine check (Trusted Source Block)
Informational
18006
Timed Group Enabled / Expired (see the second bullet in the following Notes)
Informational
18007
Policy Load Status
Policy corrupted -> Critical
Corruption Cleared -> Informational
18999
The IPS Event table is full. Further events are ignored until events are archived.
<Not generated by HIP Client>
NOTES:
There are no firewall blocking events sent back to ePO because of excessive bandwidth.
New functionality was introduced in Host IPS 8.0 Patch 4. For more information, see "Reporting for timed groups usage" in the Host IPS 8.0 Patch 4 Release Notes (PD25043). This functionality is related to Network IPS Signature 6025 - Timed Group Enabled / Expired.
関連情報
For information about how to query the ePO database for Host IPS 8.0 content signatures with CVE numbers, see KB82313.
For information about the Host IPS 8.0 Update 6 for Windows policy failover feature, see KB85187.
