End point security signature criticality

[Ilyes23i]

Hello,

Please I have a question regarding the logs for the McAfee Exploit Prevention, i exported the policy for our enterprise in order to check and analyse the available rules  for the Exploit Prevention Module.

In the exported XML file i found for each rule several information and the most important information for me is "SignatureSeverity" for this attribute i found several value from 1- 4 and i want to know how can i read this information : 

- Is the severity value "1" is more critical than the severity value "4" or the logic is the inverse ?

In another word i want to know the criticality High is the value "1" or the value "4" ?

Thnaks for the help,

Best regards,

[Pravas]

Hi @Ilyes23i ,

Unfortunately I don't have access to HIPS anymore.

Since HIPS migrates to ENS Exploit Prevention, I would presume they are identical.

In Exploit Prevention, the severity levels are as follows

High - 4

Medium  - 3

Low - 2

Thanks

[ktankink]

Hi @Ilyes23i 

Please refer to "Severity levels" from https://docs.trellix.com/bundle/endpoint-security-10.7.x-product-guide-windows/page/GUID-D5EE4D68-0C...

High = 4
Medium = 3
Low = 2
Informational = 1
Disabled = 0