Migrating HIPS Expert Rules to ENS

[curo]

I am attempting to migrate our VSE/HIPS policies to ENS using the Endpoint Migration Assistant. We have several custom HIPS rules. The ones that were created using "Standard Subrules" have migrated to the ENS Access Protection policy with no issue.  But anything that was using an "Expert Subrule" does not appear to get migrated anywhere.  Is this normal?

If there's is no way to migrate these automatically, is there a tool or anything that can assist with converting the syntax of these rules into a AAC-based Expert rule to be used in the Exploit Prevention policy?

[Former Member · Accepted solution]

Hi @curo 

The IPS Expert Rules created as a sub-rule migrate to the ENSTP EP policy as described in the the guide:

https://docs.mcafee.com/bundle/endpoint-security-migration-guide-epolicy-orchestrator-windows/page/G...

As you can see, there are some that will not migrate and need to be re-created.

[curo]

Thanks for the link.  Our rules are mainly file-based so yeah it looks like I will need to recreate them.

[Former Member]

Ah, sorry to hear! Hopefully you can use it as an opportunity to review the rules and see if you still need all of them? (trying to put a positive spin on it 🙂 )