Summary of parameters and directives, 186 | McAfee 6.1 instruction

McAfee® Host Intrusion Prevention 6.1 Product Guide	Writing Custom Signatures
	Summary of parameters and directives

A

Summary of parameters and directives

The following is a summary of parameters and directives according to type.

List of parameters according to type

Type	Parameters

Files, Windows Platform	Application, Destination File, Files, User Name

HTTP, Windows	Application, Method, Query, URL, User Name
Platform

Files, Solaris and Linux	Application, Source, Files, User Name
Platform

Registry	Application, Registry Key, User Name, Registry Value

Services	Application, Display Name, Service, User Name

Apache, Solaris Platform	Application, URL, Query, Method, User Name

List of directives according to type

:

Type	Directives

Files, Windows Platform	create, read, write, execute, delete, rename, attribute

HTTP, Windows	request
Platform

Files, Solaris Platform	create, symlink, link, chown, chmod, write, rmdir, chdir, read,
	unlink, mkdir, rename

Files, Linux Platform	create, link, setattr, write, rmdir, read, unlink, mkdir, rename

Registry	create, read, delete, modify, permissions, enumerate, monitor,
	restore, replace, load

Services	start, stop, pause, continue, startup, profile_enable,
	profile_disable, logon, create, delete

Apache, Solaris Platform	request

186

Image 186

McAfee 6.1 manual Summary of parameters and directives, List of parameters according to type, 186

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion New features What’s new in this releaseChanges from the previous release Using this guide Audience Bold Condensed ConventionsThis guide uses the following conventions Example Getting product information Standard documentation Customer Service Professional ServicesContact information IPS feature Basic ConceptsSignature rules Reactions Behavioral rulesEvents Exception rules Firewall feature Firewall rulesClient firewall rules Application Blocking feature General featureClient application blocking rules Policy management Policy enforcementPolicies and policy categories Policy inheritance and assignment Policy ownershipPolicy assignment locking Preset protection Adaptive and Learn modeDeployment and management Tuning Reports Using ePolicy Orchestrator „ Deploy Host Intrusion Prevention clients EPolicy Orchestrator console EPolicy Orchestrator console Policy management Assign Policies Assigning owners to policies Installing the Host Intrusion Prevention serverHost Intrusion Prevention operations Generating notifications Deploying Host Intrusion Prevention clients Viewing and working with client data Placing clients in Adaptive or Learn mode Configuring policies Policy viewing alerts Fine-tuning Active X control security warning Using Help Help navigation procedures IPS Exception Rules Help in the user interfaceIPS Events/Signatures IPS Signature Rules IPS Policies Overview Host and network IPS signature rules Benefits of Host IPS Preset IPS policies Behavioral rulesBenefits of Network IPS Configuring the IPS Options policy Quick accessTo configure the IPS Options policy IPS Options dialog box appears Click ApplyTo create a new IPS Options policy Select the needed options Configuring the IPS Protection policy To configure the IPS Protection policy To create a new IPS Protection policy IPS Protection dialog box appears Select the type of reaction for each severity level Configuring the IPS Rules policy To assign IPS Rules policiesTo create a new IPS Rules policy IPS Rules policy details Creating exception rules To create an exception Editing exception rules You can view and edit details of an existing exceptionTo edit an exception rule Deleting exception rules To disable/enable an exceptionEnabling and disabling exception rules Moving exception rules to another policy Host signatures SignaturesTypes of signatures Custom host signatures Viewing signatures IPS Rules-Signatures tab Creating custom signatures To modify default signaturesModifying host and network signatures To modify the view of signatures Using the wizard to create signatures To create signatures using the wizard Using the standard mode to create signatures To create a signature with the standard mode New Custom Signature-General tab To use Standard Method To use Expert Method Editing custom signaturesDeleting custom signatures To edit a custom signature Application Protection Rules 11 Application Protection Rules analysis To create an application protection rule 12 IPS Rules-Application Protection Rules 13 New Trusted Application dialog box-General tab Enabling and disabling Application Protection Rules IPS EventsEditing Application Protection Rules Deleting Application Protection Rules Viewing events To view IPS events Configuring the event view Filtering eventsTo change the event view To mark an event as unread Marking eventsTo mark an event as read To hide an event „ Agent „ Signatures „ User „ Process „ Severity Level Marking similar eventsTo mark similar events Hidden Viewing event details Creating event-based exceptions and trusted applicationsTo view event details To create an event-based exception To create an event-based trusted application IPS Client Rules Searching for related exceptionsTo search for a related exception Regular View To migrate client rules to an IPS Rules policy Aggregated View To aggregate client rulesClick the Aggregate View tab on the IPS Client Rules tab Search IPS Exception Rules To search for exceptions and manage the list of exceptions 22 Search IPS Exception Rules tab Firewall Policies HIP 6.0 rules HIP 6.1 rules State table Stateful packet filteringStateful packet inspection How firewall rules work Ordering the firewall rule list How stateful filtering works Stateful filtering process How stateful packet inspection works Stateful protocol trackingProtocol Description of handling Firewall rule groups and connection-aware groups TCP Overview Firewall Learn and Adaptive modes Stateful filtering Quarantine policies and rules Preset Firewall policies Migrating custom 6.0 firewall rules to 6.1 rulesTo migrate rules Select For these settings Off McAfee Default Configuring the Firewall Options policyTo configure the Firewall Options policy Learn Create New Policy dialog box appears „ Select New Policy Configuring the Firewall Rules policy Creating new Firewall Rules policiesTo create a Firewall Rules policy Include Local Subnet Automatically selected Select this For this protection Policy Server Medium Server High To view and edit a firewall rule Viewing and editing firewall rulesDo any of the following Add Policy or Duplicate Policy Select the appropriate settings Click OK Creating a new firewall rule or firewall groupTo create a firewall rule To create a connection-aware group To create a new rule groupFirewall Rule Group dialog box appears Type a name for this group in the Name field Deleting a firewall rule or group To add predefined rulesTo delete a firewall rule or group Viewing firewall client rules To view all firewall client rulesTo modify the view, do any of the following To view aggregated firewall client rules To view details of an aggregated firewall rule Configuring the Quarantine Options policy To configure the Quarantine Options policySelect New Policy Creating new Quarantine Rules policies Configuring the Quarantine Rules policyQuarantine Rules policy provides access for To create a Quarantine Rules policy Viewing and editing quarantine rules To view and edit a quarantine ruleClick Properties To create a quarantine rule Creating a new quarantine rule or groupDeleting a quarantine rule or group To delete a quarantine rule or group Application Blocking Policies Application creation Preset Application Blocking policies Application Blocking feature contains two policy categoriesApplication hooking Configuring the Application Blocking Options policy Select this policy For these settings Off McAfee DefaultTo apply an Application Blocking Options policy Application Blocking Options Configuring the Application Blocking Rules policy Creating new Application Blocking Rules policiesTo create an Application Blocking Rules policy Viewing and editing Application Blocking Rules To view and edit an application blocking rule Application Rule dialog box appears Creating new Application Blocking RulesTo create a new application blocking rule 100 To delete an application blocking rule Deleting an application blocking ruleViewing application client rules To view all client application rules To view aggregated client application rules To view details of an aggregated client application rule General Policies Preset General policies General feature contains four policy categories To change the policy setting Configuring Enforce PoliciesConfiguring the Client UI policy Regular User Creating and applying a Client UI policy Administrator UserTo configure a Client UI policy Disconnected User Setting passwords 107 To create an administrator password Click the Advanced Options tab in the Client UI policy108 To create a time-based password Tray icon controlTo provide tray icon control of Windows UI Configuring the Trusted Networks policy To configure trusted network options110 Remove Select To do this AddEdit Include Local Subnet To create a new policy Configuring the Trusted Applications policyCreating and applying Trusted Applications policies Trusted Application tab appears Creating trusted applications To create a trusted application Enabling and disabling trusted applications To disable/enable a trusted applicationEditing trusted applications Deleting trusted applications Analyzing IPS events MaintenanceFine-tuning a deployment 115 Creating and applying new policies Creating exception rules and trusted application rulesWorking with client exception rules For details on working with client rules, see Policies tab Policy maintenance and tasksTo view and reset broken inheritance below a specific node Policy inheritance and assignment To copy and paste policy assignments of a node Click Copy policy assignments Viewing policy information To view nodes where a policy is assignedPolicy Catalog To view all policies that have been created To view the settings and owner of a policy To view assignments where policy enforcement is disabledEditing policy information To edit a policy Event Archiver Running server tasksDirectory Gateway Property Translator Setting up notifications for events How notifications workCreating rules Host Intrusion Prevention notifications 124 Running reports Pre-defined reportsReport repository Summary information and details Report content controlHost Intrusion Prevention reports IPS Events Summary by Signature IPS Event Summary by Target Network Intrusion Summary by Source IPSignature Blocked Application Summary Top 10 Attacked Nodes for IPSTop 10 Triggered Signatures Filters on platform and signature type Failed Quarantine Updates Top 10 Blocked ApplicationsInitial View Drill Down Host Name Updating Checking in the update packageTo add update packages automatically From the Task type list, select Repository Pull To have a client request an update To add update packages manuallyTo run an update task Updating clients Host Intrusion Prevention Client Windows client System tray icon Client console133 To unlock the Host Intrusion Prevention interface Setting optionsUnlocking the client interface To customize client options Show tray icon Error Reporting Error ReportingTroubleshooting Select For this To set IPS logging options To set Firewall logging optionsSecurity Violations Alerts Intrusion alerts137 138 To respond to a firewall Learn Mode alertFirewall alerts Has the Treat rule match as an intrusion option selected Application Blocking alerts Quarantine alerts Spoof Detected alerts„ The IP address that the traffic pretends to come from 140 141 IP Spoof Detected Alert dialog box To customize IPS Policy options IPS Policy tabIPS Policy options 142 To edit the exception rules IPS Policy exception rulesException rules list 143 To customize Firewall Policy options Firewall Policy tabFirewall Policy options 144 Firewall Policy Rules Firewall rules list145 To customize Application Policy options Application Policy tabApplication Policy options 146 Application Policy rules Application rules list147 148 Blocked Hosts tabBlocked Hosts list Column What it shows To edit the Blocked Hosts list 149Until removed This list shows all monitored processes on the client Application Protection tabApplication Protection list 150 To customize Activity Log options Activity Log tabActivity Log options 151 Select Create Sniffer Capture... Activity Log list152 McAfee Host Intrusion Prevention Options Solaris client TroubleshootingClient installation issues Policy enforcement with the Solaris client 154 Client operations issuesRun this command To do this File/Directory Name Description To stop a Solaris client To restart a Solaris client155 Linux client Policy enforcement with the Linux client Verifying the client is running File Name Description Troubleshooting tool 158 To restart a Linux client Run the command hipts agent offTo stop a Linux client 159 What is the McAfee Default policy? Frequently Asked QuestionsWhat is a policy? 160 161 How do I view IPS events triggered by clients? How do I create an exception based on an IPS Event? How do I create custom signatures for an IPS Policy? How do I find existing policies that match a given profile? Basic structure of a rule is the following Writing Custom SignaturesRule Structure 164 Mandatory common sections 165Section Name Value Description Use of Include and Exclude Name/domain user name Optional common sections Section value variablesUse of the dependencies section Use of predefined variables Use of wildcardsUse of environment variables Windows IIS Web Server MS SQL Database Server Solaris Apache and iPlanet169 Class Files This topic describes how to write Windows custom signaturesWindows Custom Signatures 170 171 Advanced Details GUI name Explanation Class Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Class Services Section Values Meaning/remarks GUI Name Explanation Possible Values Windows Custom Signatures Class UNIXfile This topic describes how to write Solaris custom signaturesSolaris Custom Signatures 181 Relevant X directives per section Directive File Source File permission New permission Advanced Details Class UNIXapache183 Solaris Custom Signatures Linux Custom Signatures 185 List of directives according to type Summary of parameters and directivesList of parameters according to type 186 Glossary 187 188 Blocked host 189 Console tree 190 EPolicy Orchestrator database server 191 See also minimal properties 192 Inactive agent 193 Policy enforcement interval 194 Severity level 195 SYN flood Index Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com