ESET ERA v5 - HIPS - unknown operation

[bbahes 29]

Hi!

 

I have noticed in HIPS logs strange Operation unknown operation and strange Rule int3rn4l.

Included in attachment is list of HIPS rules I have defined on ERA.

As I look configuration from clients I also don't notice this rule.

What could be generating this strange rule name?

 

ERA 5.3.39.0

EES 5.0.2265

Edited November 22, 2016 by bbahes

[Marcos 5,074]

It's an internal rule which is logged only in diagnostic mode, ie. when logging of blocked operations is enabled. You should enable this option only while troubleshooting a HIPS-related issue, otherwise huge logs may be generated and the system performance may be affected too.

[bbahes 29]

It's an internal rule which is logged only in diagnostic mode, ie. when logging of blocked operations is enabled. You should enable this option only while troubleshooting a HIPS-related issue, otherwise huge logs may be generated and the system performance may be affected too.

 

In Windows Desktop v5 > Kernel > Settings > Log Files > Save logs from level: Informative records is selected and unmarked.

Is there any other policy rule that could activate this diagnostics?

[Marcos 5,074]

You can find the setting here:

 

[bbahes 29]

You can find the setting here:

 

erav5_hips_debuglogging.png

 

It's off. Should I turn it on?

[Marcos 5,074]

It's turn off by default. So either enabled it in a policy that was applied on clients or it was enabled manually if the advanced HIPS setup on clients.

[bbahes 29]

It's turn off by default. So either enabled it in a policy that was applied on clients or it was enabled manually if the advanced HIPS setup on clients.

 

Clients are all controlled by policy in which this setting is unchecked.

[Marcos 5,074]

If you check Endpoint's configuration on such client manually,is the setting enabled?

[bbahes 29]

If you check Endpoint's configuration on such client manually,is the setting enabled?

 

No, it's disabled (unchecked).

[Marcos 5,074]

The thing is HIPS doesn't log basically anything by default. Please collect logs from a computer where this message is still being logged using ESET Log Collector and pm me the output archive. If too large to send via pm, upload it to a safe location and pm me the download link.