Firewall event log grouping

[Elvinas]

Hello,

Had a few questions regarding blocked traffic logs shown in the FirewallEventMonitor.log as seen on some other tread it is possible to turn on so that these would be displayed in UI as events in ePO. (tread: https://communitym.trellix.com/t5/Endpoint-Security-ENS/Firewall-Events-not-showing-in-in-GUI-Event-...)

In the log most of the observed entries fall under "Matched Rule: Block all traffic" if they were to be turned on, would there be a possibility to differentiate them more, or would all be under the same event?

Any idea on how much additional space could these events could take?

Thanks in advance for any information.

[rfranci · Accepted solution]

Hi @Elvinas ,

Thankyou for reaching us on community !

If you want all block events to be sent to EPO then, you will have to enable this in ENS common options policy for firewall to report 'All' events because the 'traffic blocked by firewall' event falls under "info" category. By default only 'critical and alert' category events are sent to EPO.

With that said, it is important to note that this configuration is not recommended all the time. Because, ENS firewall is designed with a hard coded rule to "block all traffic" and that will generate thousands of events at a time and this is capable of breaking your SQL server If you are using EPO onprime with SQL .

You can imagine rules arranged in a stack.
When a traffic is generated, ENS firewall compares the traffic with each and every rule in the firewall rules policy -rules stack in top-down approach.

The "block all traffic" rule is hard coded to be at the bottom of the stack.

So any allow or block rule that is configured by you or that comes by default is given preference . All the other traffic that doesn't match any rules in the rule stack of firewall rules policy makes its way to bottom of the stack and finally that traffic is blocked by 'block all traffic' rule.

Let say you have another rule at the top of the stack to block port 3389 and you name the rule as "block remote". once the policy applied to a machine and if you try to RDP into that machine, the traffic will be blocked by ENS firewall based on the rule "block remote" created by you . So, in the FirewallEventMonitor.log  you will see the logging as "Matched Rule: block remote" 

By default FirewallEventMonitor.log must take only 10 MB of space on disk and the logs will roll over very fast if there is a lot of traffic that is getting generated. The rate of speed at which this logs can rollover depends upon the number of traffic that is getting generated and whether you have 'log all blocked traffic' only enabled or even 'log all allowed traffic' as well.

I hope this helps.

-Rohit Francis 
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[Elvinas]

@rfranci 

Thank you for the detailed response. Found it quite helpful.

[ktankink]

Hi @Elvinas 

Please be aware of this KB below.  Logging excessive events to the ePO server (which includes the ENS console Events menu) can cause issues.

KB90177 - Enabling the 'Treat match as intrusion' or 'Log matching traffic' logging options might cause high CPU use
https://kcm.trellix.com/corporate/index?page=content&id=KB90177