Manuals / McAfee / Marine Equipment / Marine Radio

McAfee 6.1 manual Fine-tuning, Active X control security warning

Models: 6.1

1 201

Download 201 pages 13.13 Kb

Page 30

McAfee® Host Intrusion Prevention 6.1 Product Guide	Using ePolicy Orchestrator
	Host Intrusion Prevention operations

3

Some Firewall feature policies require an ActiveX control. In opening one of these policies, you may be asked to run the control that is needed to display the policy content. If this alert appears, click Yes to display the details of the policy.

Figure 3-5 Active X control security warning

Fine-tuning

After you install the Host Intrusion Prevention software, McAfee recommends that you configure it to provide the greatest amount of security while not conflicting with day-to-day activities. The default policies in Host Intrusion Prevention fit the broadest set of customer environments and may meet your needs. To fine-tune policies to fit your particular setting, we recommend the following practices:

Carefully define your Host Intrusion Prevention security configuration. Evaluate who is responsible for configuring particular parts of the system and grant them appropriate access.

Change the default IPS Protection or Firewall Rules policies, which provide increasing levels of preset protection.

Modify severity levels of specific signatures. For example, when a signature is triggered by day-to-day work of users, adjust the severity level to a lower level. For more information, refer to Configuring the IPS Protection policy on page 38.

Configure notifications, which alert specific individuals when particular events occur. For example, a notification can be sent when an activity that triggers a High severity event occurs on a particular server. For more information, refer to Setting up notifications for events on page 123.

30

Image 30

McAfee 6.1 manual Fine-tuning, Active X control security warning

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion New features What’s new in this releaseChanges from the previous release Using this guide AudienceBold Condensed ConventionsThis guide uses the following conventions ExampleGetting product information Standard documentationCustomer Service Professional ServicesContact information IPS feature Basic ConceptsSignature rules Reactions Behavioral rulesEvents Exception rulesFirewall feature Firewall rulesClient firewall rules Application Blocking feature General featureClient application blocking rules Policy management Policy enforcementPolicies and policy categories Policy inheritance and assignment Policy ownershipPolicy assignment locking Preset protection Adaptive and Learn modeDeployment and management Tuning ReportsUsing ePolicy Orchestrator „ Deploy Host Intrusion Prevention clientsEPolicy Orchestrator console EPolicy Orchestrator consolePolicy management Assign PoliciesAssigning owners to policies Installing the Host Intrusion Prevention serverHost Intrusion Prevention operations Generating notificationsDeploying Host Intrusion Prevention clients Viewing and working with client dataPlacing clients in Adaptive or Learn mode Configuring policies Policy viewing alertsFine-tuning Active X control security warningUsing Help Help navigation proceduresIPS Exception Rules Help in the user interfaceIPS Events/Signatures IPS Signature RulesIPS Policies OverviewHost and network IPS signature rules Benefits of Host IPSPreset IPS policies Behavioral rulesBenefits of Network IPS Configuring the IPS Options policy Quick accessTo configure the IPS Options policy IPS Options dialog box appears Click ApplyTo create a new IPS Options policy Select the needed optionsConfiguring the IPS Protection policy To configure the IPS Protection policy To create a new IPS Protection policyIPS Protection dialog box appears Select the type of reaction for each severity levelConfiguring the IPS Rules policy To assign IPS Rules policiesTo create a new IPS Rules policy IPS Rules policy details Creating exception rules To create an exceptionEditing exception rules You can view and edit details of an existing exceptionTo edit an exception rule Deleting exception rules To disable/enable an exceptionEnabling and disabling exception rules Moving exception rules to another policyHost signatures SignaturesTypes of signatures Custom host signaturesViewing signatures IPS Rules-Signatures tabCreating custom signatures To modify default signaturesModifying host and network signatures To modify the view of signaturesUsing the wizard to create signatures To create signatures using the wizardUsing the standard mode to create signatures To create a signature with the standard modeNew Custom Signature-General tab To use Standard Method To use Expert Method Editing custom signaturesDeleting custom signatures To edit a custom signatureApplication Protection Rules 11 Application Protection Rules analysisTo create an application protection rule 12 IPS Rules-Application Protection Rules13 New Trusted Application dialog box-General tab Enabling and disabling Application Protection Rules IPS EventsEditing Application Protection Rules Deleting Application Protection RulesViewing events To view IPS eventsConfiguring the event view Filtering eventsTo change the event view To mark an event as unread Marking eventsTo mark an event as read To hide an event„ Agent „ Signatures „ User „ Process „ Severity Level Marking similar eventsTo mark similar events HiddenViewing event details Creating event-based exceptions and trusted applicationsTo view event details To create an event-based exception To create an event-based trusted applicationIPS Client Rules Searching for related exceptionsTo search for a related exception Regular View To migrate client rules to an IPS Rules policyAggregated View To aggregate client rulesClick the Aggregate View tab on the IPS Client Rules tab Search IPS Exception Rules To search for exceptions and manage the list of exceptions22 Search IPS Exception Rules tab Firewall Policies HIP 6.0 rules HIP 6.1 rulesState table Stateful packet filteringStateful packet inspection How firewall rules work Ordering the firewall rule listHow stateful filtering works Stateful filtering processHow stateful packet inspection works Stateful protocol trackingProtocol Description of handling Firewall rule groups and connection-aware groups TCPOverview Firewall Learn and Adaptive modes Stateful filteringQuarantine policies and rules Preset Firewall policies Migrating custom 6.0 firewall rules to 6.1 rulesTo migrate rules Select For these settings Off McAfee Default Configuring the Firewall Options policyTo configure the Firewall Options policy LearnCreate New Policy dialog box appears „ Select New PolicyConfiguring the Firewall Rules policy Creating new Firewall Rules policiesTo create a Firewall Rules policy Include Local Subnet Automatically selected Select this For this protection Policy Server Medium Server HighTo view and edit a firewall rule Viewing and editing firewall rulesDo any of the following Add Policy or Duplicate PolicySelect the appropriate settings Click OK Creating a new firewall rule or firewall groupTo create a firewall rule To create a connection-aware group To create a new rule groupFirewall Rule Group dialog box appears Type a name for this group in the Name fieldDeleting a firewall rule or group To add predefined rulesTo delete a firewall rule or group Viewing firewall client rules To view all firewall client rulesTo modify the view, do any of the following To view aggregated firewall client rules To view details of an aggregated firewall ruleConfiguring the Quarantine Options policy To configure the Quarantine Options policySelect New Policy Creating new Quarantine Rules policies Configuring the Quarantine Rules policyQuarantine Rules policy provides access for To create a Quarantine Rules policyViewing and editing quarantine rules To view and edit a quarantine ruleClick Properties To create a quarantine rule Creating a new quarantine rule or groupDeleting a quarantine rule or group To delete a quarantine rule or groupApplication Blocking Policies Application creationPreset Application Blocking policies Application Blocking feature contains two policy categoriesApplication hooking Configuring the Application Blocking Options policy Select this policy For these settings Off McAfee DefaultTo apply an Application Blocking Options policy Application Blocking Options Configuring the Application Blocking Rules policy Creating new Application Blocking Rules policiesTo create an Application Blocking Rules policy Viewing and editing Application Blocking Rules To view and edit an application blocking ruleApplication Rule dialog box appears Creating new Application Blocking RulesTo create a new application blocking rule 100To delete an application blocking rule Deleting an application blocking ruleViewing application client rules To view all client application rulesTo view aggregated client application rules To view details of an aggregated client application ruleGeneral Policies Preset General policies General feature contains four policy categoriesTo change the policy setting Configuring Enforce PoliciesConfiguring the Client UI policy Regular UserCreating and applying a Client UI policy Administrator UserTo configure a Client UI policy Disconnected UserSetting passwords 107To create an administrator password Click the Advanced Options tab in the Client UI policy108 To create a time-based password Tray icon controlTo provide tray icon control of Windows UI Configuring the Trusted Networks policy To configure trusted network options110 Remove Select To do this AddEdit Include Local SubnetTo create a new policy Configuring the Trusted Applications policyCreating and applying Trusted Applications policies Trusted Application tab appearsCreating trusted applications To create a trusted applicationEnabling and disabling trusted applications To disable/enable a trusted applicationEditing trusted applications Deleting trusted applicationsAnalyzing IPS events MaintenanceFine-tuning a deployment 115Creating and applying new policies Creating exception rules and trusted application rulesWorking with client exception rules For details on working with client rules, seePolicies tab Policy maintenance and tasksTo view and reset broken inheritance below a specific node Policy inheritance and assignmentTo copy and paste policy assignments of a node Click Copy policy assignmentsViewing policy information To view nodes where a policy is assignedPolicy Catalog To view all policies that have been createdTo view the settings and owner of a policy To view assignments where policy enforcement is disabledEditing policy information To edit a policy Event Archiver Running server tasksDirectory Gateway Property TranslatorSetting up notifications for events How notifications workCreating rules Host Intrusion Prevention notifications 124Running reports Pre-defined reportsReport repository Summary information and details Report content controlHost Intrusion Prevention reports IPS Events Summary by SignatureIPS Event Summary by Target Network Intrusion Summary by Source IPSignature Blocked Application Summary Top 10 Attacked Nodes for IPSTop 10 Triggered Signatures Filters on platform and signature typeFailed Quarantine Updates Top 10 Blocked ApplicationsInitial View Drill Down Host Name Updating Checking in the update packageTo add update packages automatically From the Task type list, select Repository PullTo have a client request an update To add update packages manuallyTo run an update task Updating clientsHost Intrusion Prevention Client Windows clientSystem tray icon Client console133 To unlock the Host Intrusion Prevention interface Setting optionsUnlocking the client interface To customize client optionsShow tray icon Error Reporting Error ReportingTroubleshooting Select For thisTo set IPS logging options To set Firewall logging optionsSecurity Violations Alerts Intrusion alerts137 138 To respond to a firewall Learn Mode alertFirewall alerts Has the Treat rule match as an intrusion option selectedApplication Blocking alerts Quarantine alerts Spoof Detected alerts„ The IP address that the traffic pretends to come from 140 141 IP Spoof Detected Alert dialog boxTo customize IPS Policy options IPS Policy tabIPS Policy options 142To edit the exception rules IPS Policy exception rulesException rules list 143To customize Firewall Policy options Firewall Policy tabFirewall Policy options 144Firewall Policy Rules Firewall rules list145 To customize Application Policy options Application Policy tabApplication Policy options 146Application Policy rules Application rules list147 148 Blocked Hosts tabBlocked Hosts list Column What it showsTo edit the Blocked Hosts list 149Until removed This list shows all monitored processes on the client Application Protection tabApplication Protection list 150To customize Activity Log options Activity Log tabActivity Log options 151Select Create Sniffer Capture... Activity Log list152 McAfee Host Intrusion Prevention OptionsSolaris client TroubleshootingClient installation issues Policy enforcement with the Solaris client154 Client operations issuesRun this command To do this File/Directory Name DescriptionTo stop a Solaris client To restart a Solaris client155 Linux client Policy enforcement with the Linux clientVerifying the client is running File Name DescriptionTroubleshooting tool 158To restart a Linux client Run the command hipts agent offTo stop a Linux client 159What is the McAfee Default policy? Frequently Asked QuestionsWhat is a policy? 160161 How do I view IPS events triggered by clients? How do I create an exception based on an IPS Event?How do I create custom signatures for an IPS Policy? How do I find existing policies that match a given profile?Basic structure of a rule is the following Writing Custom SignaturesRule Structure 164Mandatory common sections 165Section Name Value Description Use of Include and Exclude Name/domain user nameOptional common sections Section value variablesUse of the dependencies section Use of predefined variables Use of wildcardsUse of environment variables Windows IIS Web ServerMS SQL Database Server Solaris Apache and iPlanet169 Class Files This topic describes how to write Windows custom signaturesWindows Custom Signatures 170171 Advanced Details GUI name ExplanationClass Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Class Services Section Values Meaning/remarksGUI Name Explanation Possible Values Windows Custom Signatures Class UNIXfile This topic describes how to write Solaris custom signaturesSolaris Custom Signatures 181Relevant X directives per section Directive File Source File permission New permissionAdvanced Details Class UNIXapache183 Solaris Custom Signatures Linux Custom Signatures 185List of directives according to type Summary of parameters and directivesList of parameters according to type 186Glossary 187188 Blocked host189 Console tree190 EPolicy Orchestrator database server191 See also minimal properties192 Inactive agent193 Policy enforcement interval194 Severity level195 SYN floodIndex Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com