From the policy, enable Exploit Prevention and update signature 50001 with block and report access. Apply the policy to the client machine.
Run the command to check if Exploit Prevention is enabled or disabled.
./mfetpcli --getepstatusTo check the status of signatures, run:
./mfetpcli --getallepsignaturesNote
Block and report status for signature ID 50001 should be shown as enabled.
Use this command to check violation of the rule:
touch/usr/bin/watchbog
You will see permission denied as the Block status is enabled. And the event is reported to ePO.