Manuals / McAfee / Marine Equipment / Marine Radio

McAfee 6.1 manual Unlocking the client interface, Setting options, To customize client options

Models: 6.1

1 201

Download 201 pages 13.13 Kb

Page 134

McAfee® Host Intrusion Prevention 6.1 Product Guide	Host Intrusion Prevention Client
	Windows client

9

The console lets you configure and view information about Host Intrusion Prevention features. It contains several tabs, which correspond to a specific Host Intrusion Prevention feature. For details, see:

IPS Policy tab on page 142

Firewall Policy tab on page 144

Application Policy tab on page 146

Blocked Hosts tab on page 148

Application Protection tab on page 150

Activity Log tab on page 151

Unlocking the client interface

An administrator remotely managing Host Intrusion Prevention using ePolicy Orchestrator can password protect the interface to prevent accidental changes. With a time-based and computer-specific password, an administrator or user can temporarily unlock the interface and make changes.

To unlock the Host Intrusion Prevention interface:

1Obtain a password from the Host Intrusion Prevention administrator.

For details on creating a password, see Setting passwords on page 107.

2On the Task menu, select Unlock User Interface.

The Login dialog box appears.

3Type the password and click OK. If the password is an administrator password, and not a timed password, select Administrator password before clicking OK.

Setting options

The Host Intrusion Prevention client console provides access to some settings delivered by the Client UI policy and enables you to customize them for the individual client.

To customize client options:

1On the Edit menu click Options.

The Host Intrusion Prevention Options dialog box appears.

2Select and deselect options as needed.

Select...	For this...

Display pop-up alert	An alert dialog box appears when an attack occurs.
	For details, see Alerts.

Play sound	A sound plays when an attack occurs.

Flash tray icon	The icon toggles between regular status and
	attack status when an attack occurs.

134

Image 134

McAfee 6.1 manual Unlocking the client interface, Setting options, To unlock the Host Intrusion Prevention interface

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion Changes from the previous release New featuresWhat’s new in this release Using this guide AudienceBold Condensed ConventionsThis guide uses the following conventions ExampleGetting product information Standard documentationContact information Customer ServiceProfessional Services Signature rules IPS featureBasic Concepts Reactions Behavioral rulesEvents Exception rulesClient firewall rules Firewall featureFirewall rules Client application blocking rules Application Blocking featureGeneral feature Policies and policy categories Policy managementPolicy enforcement Policy assignment locking Policy inheritance and assignmentPolicy ownership Deployment and management Preset protectionAdaptive and Learn mode Tuning ReportsUsing ePolicy Orchestrator „ Deploy Host Intrusion Prevention clientsEPolicy Orchestrator console EPolicy Orchestrator consolePolicy management Assign PoliciesAssigning owners to policies Installing the Host Intrusion Prevention serverHost Intrusion Prevention operations Generating notificationsDeploying Host Intrusion Prevention clients Viewing and working with client dataPlacing clients in Adaptive or Learn mode Configuring policies Policy viewing alertsFine-tuning Active X control security warningUsing Help Help navigation proceduresIPS Exception Rules Help in the user interfaceIPS Events/Signatures IPS Signature RulesIPS Policies OverviewHost and network IPS signature rules Benefits of Host IPSBenefits of Network IPS Preset IPS policiesBehavioral rules To configure the IPS Options policy Configuring the IPS Options policyQuick access IPS Options dialog box appears Click ApplyTo create a new IPS Options policy Select the needed optionsConfiguring the IPS Protection policy To configure the IPS Protection policy To create a new IPS Protection policyIPS Protection dialog box appears Select the type of reaction for each severity levelTo create a new IPS Rules policy Configuring the IPS Rules policyTo assign IPS Rules policies IPS Rules policy details Creating exception rules To create an exceptionTo edit an exception rule Editing exception rulesYou can view and edit details of an existing exception Deleting exception rules To disable/enable an exceptionEnabling and disabling exception rules Moving exception rules to another policyHost signatures SignaturesTypes of signatures Custom host signaturesViewing signatures IPS Rules-Signatures tabCreating custom signatures To modify default signaturesModifying host and network signatures To modify the view of signaturesUsing the wizard to create signatures To create signatures using the wizardUsing the standard mode to create signatures To create a signature with the standard modeNew Custom Signature-General tab To use Standard Method To use Expert Method Editing custom signaturesDeleting custom signatures To edit a custom signatureApplication Protection Rules 11 Application Protection Rules analysisTo create an application protection rule 12 IPS Rules-Application Protection Rules13 New Trusted Application dialog box-General tab Enabling and disabling Application Protection Rules IPS EventsEditing Application Protection Rules Deleting Application Protection RulesViewing events To view IPS eventsTo change the event view Configuring the event viewFiltering events To mark an event as unread Marking eventsTo mark an event as read To hide an event„ Agent „ Signatures „ User „ Process „ Severity Level Marking similar eventsTo mark similar events HiddenTo view event details Viewing event detailsCreating event-based exceptions and trusted applications To create an event-based exception To create an event-based trusted applicationTo search for a related exception IPS Client RulesSearching for related exceptions Regular View To migrate client rules to an IPS Rules policyClick the Aggregate View tab on the IPS Client Rules tab Aggregated ViewTo aggregate client rules Search IPS Exception Rules To search for exceptions and manage the list of exceptions22 Search IPS Exception Rules tab Firewall Policies HIP 6.0 rules HIP 6.1 rulesStateful packet inspection State tableStateful packet filtering How firewall rules work Ordering the firewall rule listHow stateful filtering works Stateful filtering processProtocol Description of handling How stateful packet inspection worksStateful protocol tracking Firewall rule groups and connection-aware groups TCPOverview Firewall Learn and Adaptive modes Stateful filteringQuarantine policies and rules To migrate rules Preset Firewall policiesMigrating custom 6.0 firewall rules to 6.1 rules Select For these settings Off McAfee Default Configuring the Firewall Options policyTo configure the Firewall Options policy LearnCreate New Policy dialog box appears „ Select New PolicyTo create a Firewall Rules policy Configuring the Firewall Rules policyCreating new Firewall Rules policies Include Local Subnet Automatically selected Select this For this protection Policy Server Medium Server HighTo view and edit a firewall rule Viewing and editing firewall rulesDo any of the following Add Policy or Duplicate PolicyTo create a firewall rule Select the appropriate settings Click OKCreating a new firewall rule or firewall group To create a connection-aware group To create a new rule groupFirewall Rule Group dialog box appears Type a name for this group in the Name fieldTo delete a firewall rule or group Deleting a firewall rule or groupTo add predefined rules To modify the view, do any of the following Viewing firewall client rulesTo view all firewall client rules To view aggregated firewall client rules To view details of an aggregated firewall ruleSelect New Policy Configuring the Quarantine Options policyTo configure the Quarantine Options policy Creating new Quarantine Rules policies Configuring the Quarantine Rules policyQuarantine Rules policy provides access for To create a Quarantine Rules policyClick Properties Viewing and editing quarantine rulesTo view and edit a quarantine rule To create a quarantine rule Creating a new quarantine rule or groupDeleting a quarantine rule or group To delete a quarantine rule or groupApplication Blocking Policies Application creationApplication hooking Preset Application Blocking policiesApplication Blocking feature contains two policy categories To apply an Application Blocking Options policy Configuring the Application Blocking Options policySelect this policy For these settings Off McAfee Default Application Blocking Options To create an Application Blocking Rules policy Configuring the Application Blocking Rules policyCreating new Application Blocking Rules policies Viewing and editing Application Blocking Rules To view and edit an application blocking ruleApplication Rule dialog box appears Creating new Application Blocking RulesTo create a new application blocking rule 100To delete an application blocking rule Deleting an application blocking ruleViewing application client rules To view all client application rulesTo view aggregated client application rules To view details of an aggregated client application ruleGeneral Policies Preset General policies General feature contains four policy categoriesTo change the policy setting Configuring Enforce PoliciesConfiguring the Client UI policy Regular UserCreating and applying a Client UI policy Administrator UserTo configure a Client UI policy Disconnected UserSetting passwords 107108 To create an administrator passwordClick the Advanced Options tab in the Client UI policy To provide tray icon control of Windows UI To create a time-based passwordTray icon control 110 Configuring the Trusted Networks policyTo configure trusted network options Remove Select To do this AddEdit Include Local SubnetTo create a new policy Configuring the Trusted Applications policyCreating and applying Trusted Applications policies Trusted Application tab appearsCreating trusted applications To create a trusted applicationEnabling and disabling trusted applications To disable/enable a trusted applicationEditing trusted applications Deleting trusted applicationsAnalyzing IPS events MaintenanceFine-tuning a deployment 115Creating and applying new policies Creating exception rules and trusted application rulesWorking with client exception rules For details on working with client rules, seePolicies tab Policy maintenance and tasksTo view and reset broken inheritance below a specific node Policy inheritance and assignmentTo copy and paste policy assignments of a node Click Copy policy assignmentsViewing policy information To view nodes where a policy is assignedPolicy Catalog To view all policies that have been createdEditing policy information To view the settings and owner of a policyTo view assignments where policy enforcement is disabled To edit a policy Event Archiver Running server tasksDirectory Gateway Property TranslatorCreating rules Setting up notifications for eventsHow notifications work Host Intrusion Prevention notifications 124Report repository Running reportsPre-defined reports Summary information and details Report content controlHost Intrusion Prevention reports IPS Events Summary by SignatureSignature IPS Event Summary by TargetNetwork Intrusion Summary by Source IP Blocked Application Summary Top 10 Attacked Nodes for IPSTop 10 Triggered Signatures Filters on platform and signature typeInitial View Drill Down Host Name Failed Quarantine UpdatesTop 10 Blocked Applications Updating Checking in the update packageTo add update packages automatically From the Task type list, select Repository PullTo have a client request an update To add update packages manuallyTo run an update task Updating clientsHost Intrusion Prevention Client Windows client133 System tray iconClient console To unlock the Host Intrusion Prevention interface Setting optionsUnlocking the client interface To customize client optionsShow tray icon Error Reporting Error ReportingTroubleshooting Select For thisSecurity Violations To set IPS logging optionsTo set Firewall logging options 137 AlertsIntrusion alerts 138 To respond to a firewall Learn Mode alertFirewall alerts Has the Treat rule match as an intrusion option selectedApplication Blocking alerts „ The IP address that the traffic pretends to come from 140 Quarantine alertsSpoof Detected alerts 141 IP Spoof Detected Alert dialog boxTo customize IPS Policy options IPS Policy tabIPS Policy options 142To edit the exception rules IPS Policy exception rulesException rules list 143To customize Firewall Policy options Firewall Policy tabFirewall Policy options 144145 Firewall Policy RulesFirewall rules list To customize Application Policy options Application Policy tabApplication Policy options 146147 Application Policy rulesApplication rules list 148 Blocked Hosts tabBlocked Hosts list Column What it showsUntil removed To edit the Blocked Hosts list149 This list shows all monitored processes on the client Application Protection tabApplication Protection list 150To customize Activity Log options Activity Log tabActivity Log options 151Select Create Sniffer Capture... Activity Log list152 McAfee Host Intrusion Prevention OptionsSolaris client TroubleshootingClient installation issues Policy enforcement with the Solaris client154 Client operations issuesRun this command To do this File/Directory Name Description155 To stop a Solaris clientTo restart a Solaris client Linux client Policy enforcement with the Linux clientVerifying the client is running File Name DescriptionTroubleshooting tool 158To restart a Linux client Run the command hipts agent offTo stop a Linux client 159What is the McAfee Default policy? Frequently Asked QuestionsWhat is a policy? 160161 How do I view IPS events triggered by clients? How do I create an exception based on an IPS Event?How do I create custom signatures for an IPS Policy? How do I find existing policies that match a given profile?Basic structure of a rule is the following Writing Custom SignaturesRule Structure 164Section Name Value Description Mandatory common sections165 Use of Include and Exclude Name/domain user nameUse of the dependencies section Optional common sectionsSection value variables Use of predefined variables Use of wildcardsUse of environment variables Windows IIS Web Server169 MS SQL Database ServerSolaris Apache and iPlanet Class Files This topic describes how to write Windows custom signaturesWindows Custom Signatures 170171 Advanced Details GUI name ExplanationClass Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Class Services Section Values Meaning/remarksGUI Name Explanation Possible Values Windows Custom Signatures Class UNIXfile This topic describes how to write Solaris custom signaturesSolaris Custom Signatures 181Relevant X directives per section Directive File Source File permission New permission183 Advanced DetailsClass UNIXapache Solaris Custom Signatures Linux Custom Signatures 185List of directives according to type Summary of parameters and directivesList of parameters according to type 186Glossary 187188 Blocked host189 Console tree190 EPolicy Orchestrator database server191 See also minimal properties192 Inactive agent193 Policy enforcement interval194 Severity level195 SYN floodIndex Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com