Host Intrusion Prevention 8.0 Patch 6 for Windows enforces partial policies incorrectly (ePO 18007 event)

技術的な記事 ID: KB85187
最終更新: 9/1/2020

環境

McAfee Host Intrusion Prevention (Host IPS) 8.0 Patch 6

問題

If McAfee Agent gives a partial policy to Host IPS 8.0 for Windows, the Host IPS partial policy persists and enforces it incorrectly.

IMPORTANT: Host IPS 8.0 Patch 6 for Windows must be installed with a minimum signature content version of 6491 (released July 15, 2015).

If a policy enforcement anomaly occurs when signature 6065 is enabled, a 18007 event is sent to ePolicy Orchestrator (ePO). The event is displayed as a Network IPS signature event: Policy Load Status with Threat Name 6065.

原因

Host IPS 8.0 Patch 6 for Windows includes an updated policy corruption failover mechanism. This mechanism makes sure that policy integrity is maintained during McAfee Agent policy enforcements. The McAfee Host IPS LPC service rejects invalid or incomplete policies from McAfee Agent if it occurs for any reason.

If McAfee Agent tries to apply a corrupt policy, the Host IPS client rejects the corrupt policy and retains the "last known good" policy settings.

NOTES:

Network IPS signature ID 6065 was introduced in the July 15, 2015, content version 6491.
Signature 6065 is enabled (Information) by default for Policy Load Status monitoring to occur.

解決策

Install the newest Host IPS signature. Newer signatures have a Status advanced parameter that maintains one of the following values:

McAfee Agent delivered an invalid policy.
McAfee Agent delivered a correct policy.
McAfee Host Intrusion Prevention failed to read policy from registry.
McAfee Host Intrusion Prevention successfully read policy from registry.

IPS-related events can be queried from the ePO Queries & Reports interface.

影響を受ける製品

Host Intrusion Prevention 8.0
Known Issue/Product Defect

言語:

この記事は、次の言語で表示可能です:

English United States
Japanese

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Host Intrusion Prevention 8.0 Patch 6 for Windows enforces partial policies incorrectly (ePO 18007 event)

環境

問題

原因

解決策

関連情報

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Host Intrusion Prevention 8.0 Patch 6 for Windows enforces partial policies incorrectly (ePO 18007 event)

環境

問題

原因

解決策

関連情報

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title