Manuals / McAfee / Marine Equipment / Marine Radio

McAfee 6.1 manual General Policies, Overview

Models: 6.1

1 201

Download 201 pages 13.13 Kb

Page 103

7General Policies

The General feature of Host Intrusion Prevention provides access to policies that are general in nature and not specific to one feature.

This section describes the General feature and includes the following topics:

Overview

Configuring Enforce Policies

Configuring the Client UI policy

Configuring the Trusted Networks policy

Configuring the Trusted Applications policy

Overview

General policies apply to IPS and firewall settings and take precedence over settings in individual IPS and firewall policies.

The Enforce Policies policy is the basic on/off switch for enforcing Host Intrusion Prevention administrative policies on the client.

The Client UI policy determines which options are available to a client computer with a Host Intrusion Prevention client, including whether the client icon appears in the system tray, types of intrusion alerts, and passwords for access to the client interface.

The Trusted Networks policy lists IP addresses and subnets that are safe for communication. Trusted networks can include subnets, individual IP addresses, or ranges of IP addresses. Marking networks as trusted eliminates or reduces the need for IPS exceptions and additional firewall rules.

The Trusted Applications Rules policy lists applications that are safe, have no known vulnerabilities, and are allowed to perform any operation. Marking applications as trusted eliminates or reduces the need for IPS exceptions and additional firewall and application blocking rules. Like the IPS Rules policy (see Configuring the IPS Rules policy on page 41), this policy category can contain multiple policy instances.

Settings for Trusted Networks and Trusted Applications policies can reduce or eliminate false positives, which aids in tuning a deployment.

103

Image 103

McAfee 6.1 manual General Policies, Overview

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion What’s new in this release New featuresChanges from the previous release Audience Using this guideExample ConventionsThis guide uses the following conventions Bold CondensedStandard documentation Getting product informationProfessional Services Customer ServiceContact information Basic Concepts IPS featureSignature rules Exception rules Behavioral rulesEvents ReactionsFirewall rules Firewall featureClient firewall rules General feature Application Blocking featureClient application blocking rules Policy enforcement Policy managementPolicies and policy categories Policy ownership Policy inheritance and assignmentPolicy assignment locking Adaptive and Learn mode Preset protectionDeployment and management Reports Tuning„ Deploy Host Intrusion Prevention clients Using ePolicy OrchestratorEPolicy Orchestrator console EPolicy Orchestrator consoleAssign Policies Policy managementGenerating notifications Installing the Host Intrusion Prevention serverHost Intrusion Prevention operations Assigning owners to policiesViewing and working with client data Deploying Host Intrusion Prevention clientsPlacing clients in Adaptive or Learn mode Policy viewing alerts Configuring policiesActive X control security warning Fine-tuningHelp navigation procedures Using HelpIPS Signature Rules Help in the user interfaceIPS Events/Signatures IPS Exception RulesOverview IPS PoliciesBenefits of Host IPS Host and network IPS signature rulesBehavioral rules Preset IPS policiesBenefits of Network IPS Quick access Configuring the IPS Options policyTo configure the IPS Options policy Select the needed options Click ApplyTo create a new IPS Options policy IPS Options dialog box appearsConfiguring the IPS Protection policy To create a new IPS Protection policy To configure the IPS Protection policySelect the type of reaction for each severity level IPS Protection dialog box appearsTo assign IPS Rules policies Configuring the IPS Rules policyTo create a new IPS Rules policy IPS Rules policy details To create an exception Creating exception rulesYou can view and edit details of an existing exception Editing exception rulesTo edit an exception rule Moving exception rules to another policy To disable/enable an exceptionEnabling and disabling exception rules Deleting exception rulesCustom host signatures SignaturesTypes of signatures Host signaturesIPS Rules-Signatures tab Viewing signaturesTo modify the view of signatures To modify default signaturesModifying host and network signatures Creating custom signaturesTo create signatures using the wizard Using the wizard to create signaturesTo create a signature with the standard mode Using the standard mode to create signaturesNew Custom Signature-General tab To edit a custom signature Editing custom signaturesDeleting custom signatures To use Standard Method To use Expert Method11 Application Protection Rules analysis Application Protection Rules12 IPS Rules-Application Protection Rules To create an application protection rule13 New Trusted Application dialog box-General tab Deleting Application Protection Rules IPS EventsEditing Application Protection Rules Enabling and disabling Application Protection RulesTo view IPS events Viewing eventsFiltering events Configuring the event viewTo change the event view To hide an event Marking eventsTo mark an event as read To mark an event as unreadHidden Marking similar eventsTo mark similar events „ Agent „ Signatures „ User „ Process „ Severity LevelCreating event-based exceptions and trusted applications Viewing event detailsTo view event details To create an event-based trusted application To create an event-based exceptionSearching for related exceptions IPS Client RulesTo search for a related exception To migrate client rules to an IPS Rules policy Regular ViewTo aggregate client rules Aggregated ViewClick the Aggregate View tab on the IPS Client Rules tab To search for exceptions and manage the list of exceptions Search IPS Exception Rules22 Search IPS Exception Rules tab Firewall Policies HIP 6.1 rules HIP 6.0 rulesStateful packet filtering State tableStateful packet inspection Ordering the firewall rule list How firewall rules workStateful filtering process How stateful filtering worksStateful protocol tracking How stateful packet inspection worksProtocol Description of handling TCP Firewall rule groups and connection-aware groupsOverview Stateful filtering Firewall Learn and Adaptive modesQuarantine policies and rules Migrating custom 6.0 firewall rules to 6.1 rules Preset Firewall policiesTo migrate rules Learn Configuring the Firewall Options policyTo configure the Firewall Options policy Select For these settings Off McAfee Default„ Select New Policy Create New Policy dialog box appearsCreating new Firewall Rules policies Configuring the Firewall Rules policyTo create a Firewall Rules policy Include Local Subnet Automatically selected Server High Select this For this protection Policy Server MediumAdd Policy or Duplicate Policy Viewing and editing firewall rulesDo any of the following To view and edit a firewall ruleCreating a new firewall rule or firewall group Select the appropriate settings Click OKTo create a firewall rule Type a name for this group in the Name field To create a new rule groupFirewall Rule Group dialog box appears To create a connection-aware groupTo add predefined rules Deleting a firewall rule or groupTo delete a firewall rule or group To view all firewall client rules Viewing firewall client rulesTo modify the view, do any of the following To view details of an aggregated firewall rule To view aggregated firewall client rulesTo configure the Quarantine Options policy Configuring the Quarantine Options policySelect New Policy To create a Quarantine Rules policy Configuring the Quarantine Rules policyQuarantine Rules policy provides access for Creating new Quarantine Rules policiesTo view and edit a quarantine rule Viewing and editing quarantine rulesClick Properties To delete a quarantine rule or group Creating a new quarantine rule or groupDeleting a quarantine rule or group To create a quarantine ruleApplication creation Application Blocking PoliciesApplication Blocking feature contains two policy categories Preset Application Blocking policiesApplication hooking Select this policy For these settings Off McAfee Default Configuring the Application Blocking Options policyTo apply an Application Blocking Options policy Application Blocking Options Creating new Application Blocking Rules policies Configuring the Application Blocking Rules policyTo create an Application Blocking Rules policy To view and edit an application blocking rule Viewing and editing Application Blocking Rules100 Creating new Application Blocking RulesTo create a new application blocking rule Application Rule dialog box appearsTo view all client application rules Deleting an application blocking ruleViewing application client rules To delete an application blocking ruleTo view details of an aggregated client application rule To view aggregated client application rulesGeneral Policies General feature contains four policy categories Preset General policiesRegular User Configuring Enforce PoliciesConfiguring the Client UI policy To change the policy settingDisconnected User Administrator UserTo configure a Client UI policy Creating and applying a Client UI policy107 Setting passwordsClick the Advanced Options tab in the Client UI policy To create an administrator password108 Tray icon control To create a time-based passwordTo provide tray icon control of Windows UI To configure trusted network options Configuring the Trusted Networks policy110 Include Local Subnet Select To do this AddEdit RemoveTrusted Application tab appears Configuring the Trusted Applications policyCreating and applying Trusted Applications policies To create a new policyTo create a trusted application Creating trusted applicationsDeleting trusted applications To disable/enable a trusted applicationEditing trusted applications Enabling and disabling trusted applications115 MaintenanceFine-tuning a deployment Analyzing IPS eventsFor details on working with client rules, see Creating exception rules and trusted application rulesWorking with client exception rules Creating and applying new policiesPolicy inheritance and assignment Policy maintenance and tasksTo view and reset broken inheritance below a specific node Policies tabClick Copy policy assignments To copy and paste policy assignments of a nodeTo view all policies that have been created To view nodes where a policy is assignedPolicy Catalog Viewing policy informationTo view assignments where policy enforcement is disabled To view the settings and owner of a policyEditing policy information To edit a policy Property Translator Running server tasksDirectory Gateway Event ArchiverHow notifications work Setting up notifications for eventsCreating rules 124 Host Intrusion Prevention notificationsPre-defined reports Running reportsReport repository IPS Events Summary by Signature Report content controlHost Intrusion Prevention reports Summary information and detailsNetwork Intrusion Summary by Source IP IPS Event Summary by TargetSignature Filters on platform and signature type Top 10 Attacked Nodes for IPSTop 10 Triggered Signatures Blocked Application SummaryTop 10 Blocked Applications Failed Quarantine UpdatesInitial View Drill Down Host Name From the Task type list, select Repository Pull Checking in the update packageTo add update packages automatically UpdatingUpdating clients To add update packages manuallyTo run an update task To have a client request an updateWindows client Host Intrusion Prevention ClientClient console System tray icon133 To customize client options Setting optionsUnlocking the client interface To unlock the Host Intrusion Prevention interfaceSelect For this Error ReportingTroubleshooting Show tray icon Error ReportingTo set Firewall logging options To set IPS logging optionsSecurity Violations Intrusion alerts Alerts137 Has the Treat rule match as an intrusion option selected To respond to a firewall Learn Mode alertFirewall alerts 138Application Blocking alerts Spoof Detected alerts Quarantine alerts„ The IP address that the traffic pretends to come from 140 IP Spoof Detected Alert dialog box 141142 IPS Policy tabIPS Policy options To customize IPS Policy options143 IPS Policy exception rulesException rules list To edit the exception rules144 Firewall Policy tabFirewall Policy options To customize Firewall Policy optionsFirewall rules list Firewall Policy Rules145 146 Application Policy tabApplication Policy options To customize Application Policy optionsApplication rules list Application Policy rules147 Column What it shows Blocked Hosts tabBlocked Hosts list 148149 To edit the Blocked Hosts listUntil removed 150 Application Protection tabApplication Protection list This list shows all monitored processes on the client151 Activity Log tabActivity Log options To customize Activity Log optionsMcAfee Host Intrusion Prevention Options Activity Log list152 Select Create Sniffer Capture...Policy enforcement with the Solaris client TroubleshootingClient installation issues Solaris clientFile/Directory Name Description Client operations issuesRun this command To do this 154To restart a Solaris client To stop a Solaris client155 Policy enforcement with the Linux client Linux clientFile Name Description Verifying the client is running158 Troubleshooting tool159 Run the command hipts agent offTo stop a Linux client To restart a Linux client160 Frequently Asked QuestionsWhat is a policy? What is the McAfee Default policy?161 How do I create an exception based on an IPS Event? How do I view IPS events triggered by clients?How do I find existing policies that match a given profile? How do I create custom signatures for an IPS Policy?164 Writing Custom SignaturesRule Structure Basic structure of a rule is the following165 Mandatory common sectionsSection Name Value Description Name/domain user name Use of Include and ExcludeSection value variables Optional common sectionsUse of the dependencies section Windows IIS Web Server Use of wildcardsUse of environment variables Use of predefined variablesSolaris Apache and iPlanet MS SQL Database Server169 170 This topic describes how to write Windows custom signaturesWindows Custom Signatures Class Files171 GUI name Explanation Advanced DetailsClass Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Section Values Meaning/remarks Class ServicesGUI Name Explanation Possible Values Windows Custom Signatures 181 This topic describes how to write Solaris custom signaturesSolaris Custom Signatures Class UNIXfileDirective File Source File permission New permission Relevant X directives per sectionClass UNIXapache Advanced Details183 Solaris Custom Signatures 185 Linux Custom Signatures186 Summary of parameters and directivesList of parameters according to type List of directives according to type187 GlossaryBlocked host 188Console tree 189EPolicy Orchestrator database server 190See also minimal properties 191Inactive agent 192Policy enforcement interval 193Severity level 194SYN flood 195Index Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com