Mcafee Solidcore Change Control

[kaleem78686]

Thread Event showing :

Registry Created Event ID 20750

Registry Deleted Event ID 20751

Registry Modified Event ID 20800

How to troubleshoot, Daily 800 log events are generating.

ePO:5.10, ENS: 10.7.0.3299, Solidcore:8.3.3.129

[Pravas]

Hi @kaleem78686 ,

Solidcore monitors for any unauthorized changes. If found it logs as an event.

Some of these events may be related to NT\Authority or other system account.

These events can be either ignored or filtered out (ePO > SolidCore Events)

Thanks

[kaleem78686]

My concerned is how to stop these event logs and why these events are generating. How to troubleshoot to stop.

On end client windows event viewer is showing Solidcore detected.

[Pravas]

Hi @kaleem78686 ,

We would need to see details of an event. Navigate to SolidCore Events page on ePO. Open an event and take a screenshot. 

Please ensure to hide any Personal Identifiable Information like System or User names.

Thanks

[kaleem78686 · Accepted solution]

Kindly find attached images.

[Pravas · Accepted solution]

Hi Kaleem,

The screenshot which you've shared is from Threat Event Log. 

It appears you've Integrity Monitoring enabled for the system. Because operations like Registry Create, Registry Deleted, Registry Modified falls under Registry Monitoring.

You're either using a Blank Template or Minimal System Monitoring policy for policy (Integrity Monitoring Rules (Windows) ). Blank template tends to generate all events.

As operations by NT\Authority is considered a system operation. These can be filtered out in the policy. 

Here's a screenshot for reference.

Please refer the product guide below.

https://docs.trellix.com/bundle/change-control-8.0.0-product-guide-epolicy-orchestrator/page/GUID-19...

Hope it helps.

[kaleem78686]

Dear Pravas,

I have applied settings which you have told and monitor. But still same event logs are receiving. 

[ktankink · Accepted solution]

Hi @kaleem78686 

To add, I'm not sure what Integrity Control policies you are using, but the \REGISTRY\A events are likely generated from your assigned policies NOT having certain default exclusions.  See the "McAfee Default" policies (see attached) showing these default exclusions.

[kaleem78686]

Dear Ktankink,

We are using only important definitions to be monitor which is not related to windows files. 

then why its monitoring registry and giving event logs.

[Pravas]

Hi @kaleem78686 ,

Please send a full screenshot of the policy page that's in use.

Thanks