HIPs Threat Event - Event ID 18007, Threat Name 6065 - Generating thousands of events

[KingInTheNorth]

Starting about 2-3 weeks ago I have been getting thousands of these events an hour.

I removed logging from the exception (6065) and even disabled it, but still the events keep coming.

I am running HIPs 8 P16 (8.0.0.5316) with extension (8.0.16.1351). I am also in the process of migrating from ePO 5.9.1 to ePO 5.10 and I am receiving thousands of events on both.

Anyone have a thought on how to resolve this?

[rfranci]

Hi @KingInTheNorth ,

Thank you for reaching us on community !

the event 18007 with signature 6065 indicates that McAfee Agent delivered an incomplete/invalid policy to HIPS during policy enforcement .
You can try applying McAfee default HIPS rules policy and McAfee default IPS protection policy to a test machine to check if the machine generates any such behavior .

Also, i would recommend raising a ticket with support team to troubleshoot on this issue.

I hope comment helps.
-Rohit Francis

[KingInTheNorth]

I am fully aware of what the signature is doing. I am trying to figure out how to correct the issue. I need to know what part of the policy is causing the issue, also why disabling the signature does not prevent the threat events from occurring.

It is a constant stream of critical and information threat events, though the exceptions within the policy appear to be applying properly.

I have seen that this issue seemed to have occurred before according to KB91715.