EES 6.5 getting firewall log to ERAS

[HSW 9]

Hi,

i need some logging for firewall notifications (blocked IPs and Websites). With webcontroll i can see all logs on ERAS but firewall logs / activities do not reach the ERAS. (local i see the log entries correct)

I activate "log" for the blogged sites. But no sending to ERAS

I want to use the "firewall threat" reports on ERAS.

The Agent is configured:

Report non-ESET-installed applications, Report network firewall issues is active

Trace log verbosity = warning)

 

HSW

[Marcos 5,074]

This is not currently possible but I reckon this should be improved in ERA v7 (which will not be called ERA by the way :)).

[HSW 9]

That is realy a bad News  i test actually for replacement of our hardwarefirewall. But without Infos of blocked pages/applications/ips over the webconsole the EES is useless atm for us  did you know a approximate time/date/month/year?

EDIT: in 6.3/6.4 it was working or? Because i found some old logs from the last testings

Edited May 30, 2017 by HSW

[MichalJ 434]

Only the high severity logs are received by ERA in version 6. Endpoint 6.6 will bring possibility to adjust logging severity of firewall rules, so it will allow you to thet those logs to ERA.

[HSW 9]

Hi MichaelJ,

can i setup ESET or ERA to set firewall blocks to high severity?

[Marcos 5,074]

47 minutes ago, HSW said:

Hi MichaelJ,

can i setup ESET or ERA to set firewall blocks to high severity?

As of Endpoint 6.6 (not yet released), with the appropriate version of the Configuration engine module you will be able to set Warning logging severity so that if such rule is applied, the appropriate record will be sent to ERAS:

[HSW 9]

10 minutes ago, Marcos said:

... (not yet released)...

 

Thx i know this from the past, can you give me a approximately release date?

[MichalJ 434]

July 2017

[HSW 9]

Need more time to release?

[Peter Randziak 1,130]

Hello,

the release has been delayed a bit, but is expected to happen during the August.

Regards, P.R.