Automatic Response for threat is not working

[Former Member]

Hello,

I am currently on ePO 5.9 and I am working with Automatic Responses in order to send email notification when Malware is detected. i tried everything but the same is not working and i am not getting email for the same. i did below settings: -

Description: Event Group: ' ePO Notification Events' ; Event Type: 'Threat'

Filter: Threat Category belongs to: ' Malware Detected'.

Please Note: server task and other responses are working fine like' Master repository update succeeded' 

I have both VSE and ENS 

[LKS]

Hi vineet21,

Have you configured SMTP server in EPO. Can you successfully send a test mail from the email server configuration page under Server settings..?

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[Former Member]

Hi,

Yes SMTP server has already configured and i am able to send the test email. I am getting daily email for configured server tasks.

The problem is that only threat response is not working 

[LKS]

Great then couple of things to check. If it is particular task not triggering Email, then the issue could be either on Task configuration nor the out format (may be).

* Can you duplicate that task and check if it is triggering email.

* Orion log is the best place to see whats going on when the task initiates. Incase if you do not find anything, Orion debug may need to enable.

[Former Member]

hi,

-> tried with creating new response but no luck

-> Checked Orion log but didn't found anything. 

Please suggest if i need to change any settings on threat policy level?  

13:30:28,999 ERROR [scheduler-InternalTask-thread-15] dispatcher.ThreatNotification - Error processing notification. Operation aborted.
com.mcafee.epo.notifications.dispatcher.UnsupportedRuleConditionException: Multiple SexpDescendsFrom in sexp: com.mcafee.orion.core.query.sexp.ops.SexpAnd@a3119b0f
at com.mcafee.epo.notifications.dispatcher.NotificationUtil.findDefinedAtNodeId(NotificationUtil.java:134)
at com.mcafee.epo.notifications.dispatcher.ThreatNotification.makeWhereClause(ThreatNotification.java:278)
at com.mcafee.epo.notifications.dispatcher.DefinedAtNotification.execute(DefinedAtNotification.java:50)
at com.mcafee.epo.notifications.dispatcher.NotificationDispatcherService.fireAllEvents(NotificationDispatcherService.java:20)
at com.mcafee.epo.notifications.dispatcher.NotificationDispatcherInternalTask.run(NotificationDispatcherInternalTask.java:30)
at com.mcafee.orion.scheduler.engine.InternalTaskWrapper.run(InternalTaskWrapper.java:28)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

[YashT]

Hello @Former Member ,

Thank you for the logs,

Logs says : 13:30:28,999 ERROR [scheduler-InternalTask-thread-15] dispatcher.ThreatNotification - Error processing notification. Operation aborted.

Your issue looks similar to below article.

All ePO 'Threat Notification' automatic responses stop working when you enable a Host Intrusion Prevention 8.0 'Automatic Response'

Technical Articles ID:   KB77567

Kindly note this is applicable for :

McAfee ePolicy Orchestrator (ePO) 5.x

McAfee Host Intrusion Prevention (Host IPS) 8.0

This issue is resolved in Host IPS 8.0 Patch 6, which is available by logging in to the ServicePortal at: https://support.mcafee.com/downloads.

[LKS]

Hi vineet21,

The below error seems like there is some problem with Rule condition. Could you please show us a screenshot of the configuration.

com.mcafee.epo.notifications.dispatcher.UnsupportedRuleConditionException: Multiple SexpDescendsFrom in sexp: com.mcafee.orion.core.query.sexp.ops.SexpAnd@a3119b0f

[bodysoda]

@Former Member , here is the example of working automatic response both SNMP & Email. Try to replicate the information on your epo and report back your findings.

[cdinet]

Are there multiple "Defined At" filters defined?  If so, test by just using My Organization and see if notification triggers.

[Former Member]

Hi All,

Thanks for your suggestions and solutions.

Automatic response for threats are working now. Earlier, there were multiple auto response were configured based on different BIU's. I have deleted all and configured again. I don't know what was the issue but the same is working now after reconfiguration.