Trellix ENS Firewall Event Logs from Linux Issue

[Tim_Hedden]

I am having trouble with all of my Linux systems NOT sending any ENS Firewall "Logged" Event Logs (Primarily Blocked - 35002) to the ePO server. I have added a "Block ANY ANY" rule as well as checked the Log Matching Traffic. I also have "Log all Blocked Traffic" checked Under the Options policy. All of my Windows systems seem to be working just fine but none of my Linux systems are sending there logs to the ePO server. What am i missing?.

[ueno · Accepted solution]

Hi @Tim_Hedden ,

Since the cause is not known in the current state, to isolate the cause, please change the following settings in the policy and check the operation.

1.Enable the "Treat match as intrusion" options in the "Block ANY ANY" rule

2.Change the "Firewall events to log" option to All in Endpoint Point Security Common policy.

[Tim_Hedden]

Good Afternoon,

        Thank you for your reply, Enabling the "Treat match as Intrusion" options on the "Block ANY ANY" rule did end up working but it sent the intrusion logs to ePO as event ID 18001 instead of 35001. I am thankful that we are able to receive these logs but do you have any idea why they would not come through as Blocked Events without marking them as intrusions?. 

[ueno · Accepted solution]

Hi @Tim_Hedden ,

Sounds good. In ENSL, "Treat match as intrusion" must be enabled in the rules when sending events to ePO, so that such events will be detected by ePO.

#Reference Information
[Endpoint Security for Linux Firewall supports generating threat events for traffic that matches a firewall rule with "Treat match as intrusion" selected]
https://kcm.trellix.com/corporate/index?page=content&id=KB91336&locale=en_US

[FAQs for Endpoint Security for Linux Firewall logging]
https://kcm.trellix.com/corporate/index?page=content&id=KB91759&actp=null&viewlocale=en_US&locale=en...
<From above page>
---
Can I trigger ePolicy Orchestrator (ePO) events for ENSFWL firewall rules?
Yes. For the firewall rule for which you want to trigger ePO events, enable the Treat match as Intrusion option.
---

[Tim_Hedden]

Now that Linux Firewall Blocked events (18001) are coming through to ePO as intrusions, which is great however; Windows Blocked "intrusions - 35001" are no longer reporting to ePO. I am seeing the logs on the local systems as being blocked. I can open the ENS interface and navigate to Event Logs, there will be many 35001 logs but not a single one is sent to ePO. WHY?  

They are labeled as Alerts and yes i have it set to send "All" events.

[ueno]

Hi @Tim_Hedden,

It is difficult to guide you to the cause of the problem in the community because the cause is not immediately known, so if you need us to determine the cause, please contact us again with Service Request.