Manuals / McAfee / Marine Equipment / Marine Radio

McAfee 6.1 manual Viewing events, To view IPS events

Models: 6.1

1 201

Download 201 pages 13.13 Kb

Page 57

McAfee® Host Intrusion Prevention 6.1 Product Guide	IPS Policies
	IPS Events

4

From the list of events generated, you can determine which events are allowable and which indicate suspicious behavior. To allow events, configure the system with the following:

Exceptions — which are rules that override a signature rule. To create an exception specific to the event, see Creating and applying Trusted Applications policies on page 112.

Trusted Applications — which allow internal applications whose operations may be blocked by a signature. To create a trusted application specific to the event, see Creating and applying Trusted Applications policies on page 112).

This fine-tuning process keeps the events that do appear to a minimum, providing more time for analysis of the serious events that occur.

Viewing events

To analyze IPS events, Host Intrusion Prevention enables you to mark the events in one of three states (Unread, Read, Hidden), and then filter these events in one of several displays.

To view IPS events:

1In the console tree, select the node for which you want to view IPS events.

2Click the IPS Events quick access link at the top of the IPS feature in the policy pane; or, if the IPS Management window is open, click the IPS Events tab.

Figure 4-15 IPS Events tab

A list containing all the events associated with the client appears. By default, not all events are displayed. For details on configuring the event view, see Configuring the event view on page 58.

57

Image 57

McAfee 6.1 manual Viewing events, To view IPS events

Contents

McAfee Host Intrusion Prevention Page McAfee Host Intrusion Prevention Copyright Contents IPS Policies General Policies 103 Frequently Asked Questions 160 Writing Custom Signatures 164 IntroducingPrevention Host Intrusion New features What’s new in this releaseChanges from the previous release Audience Using this guideThis guide uses the following conventions ConventionsBold Condensed ExampleStandard documentation Getting product informationCustomer Service Professional ServicesContact information IPS feature Basic ConceptsSignature rules Events Behavioral rulesReactions Exception rulesFirewall feature Firewall rulesClient firewall rules Application Blocking feature General featureClient application blocking rules Policy management Policy enforcementPolicies and policy categories Policy inheritance and assignment Policy ownershipPolicy assignment locking Preset protection Adaptive and Learn modeDeployment and management Reports Tuning„ Deploy Host Intrusion Prevention clients Using ePolicy OrchestratorEPolicy Orchestrator console EPolicy Orchestrator consoleAssign Policies Policy managementHost Intrusion Prevention operations Installing the Host Intrusion Prevention serverAssigning owners to policies Generating notificationsViewing and working with client data Deploying Host Intrusion Prevention clientsPlacing clients in Adaptive or Learn mode Policy viewing alerts Configuring policiesActive X control security warning Fine-tuningHelp navigation procedures Using HelpIPS Events/Signatures Help in the user interfaceIPS Exception Rules IPS Signature RulesOverview IPS PoliciesBenefits of Host IPS Host and network IPS signature rulesPreset IPS policies Behavioral rulesBenefits of Network IPS Configuring the IPS Options policy Quick accessTo configure the IPS Options policy To create a new IPS Options policy Click ApplyIPS Options dialog box appears Select the needed optionsConfiguring the IPS Protection policy To create a new IPS Protection policy To configure the IPS Protection policySelect the type of reaction for each severity level IPS Protection dialog box appearsConfiguring the IPS Rules policy To assign IPS Rules policiesTo create a new IPS Rules policy IPS Rules policy details To create an exception Creating exception rulesEditing exception rules You can view and edit details of an existing exceptionTo edit an exception rule Enabling and disabling exception rules To disable/enable an exceptionDeleting exception rules Moving exception rules to another policyTypes of signatures SignaturesHost signatures Custom host signaturesIPS Rules-Signatures tab Viewing signaturesModifying host and network signatures To modify default signaturesCreating custom signatures To modify the view of signaturesTo create signatures using the wizard Using the wizard to create signaturesTo create a signature with the standard mode Using the standard mode to create signaturesNew Custom Signature-General tab Deleting custom signatures Editing custom signaturesTo use Standard Method To use Expert Method To edit a custom signature11 Application Protection Rules analysis Application Protection Rules12 IPS Rules-Application Protection Rules To create an application protection rule13 New Trusted Application dialog box-General tab Editing Application Protection Rules IPS EventsEnabling and disabling Application Protection Rules Deleting Application Protection RulesTo view IPS events Viewing eventsConfiguring the event view Filtering eventsTo change the event view To mark an event as read Marking eventsTo mark an event as unread To hide an eventTo mark similar events Marking similar events„ Agent „ Signatures „ User „ Process „ Severity Level HiddenViewing event details Creating event-based exceptions and trusted applicationsTo view event details To create an event-based trusted application To create an event-based exceptionIPS Client Rules Searching for related exceptionsTo search for a related exception To migrate client rules to an IPS Rules policy Regular ViewAggregated View To aggregate client rulesClick the Aggregate View tab on the IPS Client Rules tab To search for exceptions and manage the list of exceptions Search IPS Exception Rules22 Search IPS Exception Rules tab Firewall Policies HIP 6.1 rules HIP 6.0 rulesState table Stateful packet filteringStateful packet inspection Ordering the firewall rule list How firewall rules workStateful filtering process How stateful filtering worksHow stateful packet inspection works Stateful protocol trackingProtocol Description of handling TCP Firewall rule groups and connection-aware groupsOverview Stateful filtering Firewall Learn and Adaptive modesQuarantine policies and rules Preset Firewall policies Migrating custom 6.0 firewall rules to 6.1 rulesTo migrate rules To configure the Firewall Options policy Configuring the Firewall Options policySelect For these settings Off McAfee Default Learn„ Select New Policy Create New Policy dialog box appearsConfiguring the Firewall Rules policy Creating new Firewall Rules policiesTo create a Firewall Rules policy Include Local Subnet Automatically selected Server High Select this For this protection Policy Server MediumDo any of the following Viewing and editing firewall rulesTo view and edit a firewall rule Add Policy or Duplicate PolicySelect the appropriate settings Click OK Creating a new firewall rule or firewall groupTo create a firewall rule Firewall Rule Group dialog box appears To create a new rule groupTo create a connection-aware group Type a name for this group in the Name fieldDeleting a firewall rule or group To add predefined rulesTo delete a firewall rule or group Viewing firewall client rules To view all firewall client rulesTo modify the view, do any of the following To view details of an aggregated firewall rule To view aggregated firewall client rulesConfiguring the Quarantine Options policy To configure the Quarantine Options policySelect New Policy Quarantine Rules policy provides access for Configuring the Quarantine Rules policyCreating new Quarantine Rules policies To create a Quarantine Rules policyViewing and editing quarantine rules To view and edit a quarantine ruleClick Properties Deleting a quarantine rule or group Creating a new quarantine rule or groupTo create a quarantine rule To delete a quarantine rule or groupApplication creation Application Blocking PoliciesPreset Application Blocking policies Application Blocking feature contains two policy categoriesApplication hooking Configuring the Application Blocking Options policy Select this policy For these settings Off McAfee DefaultTo apply an Application Blocking Options policy Application Blocking Options Configuring the Application Blocking Rules policy Creating new Application Blocking Rules policiesTo create an Application Blocking Rules policy To view and edit an application blocking rule Viewing and editing Application Blocking RulesTo create a new application blocking rule Creating new Application Blocking RulesApplication Rule dialog box appears 100Viewing application client rules Deleting an application blocking ruleTo delete an application blocking rule To view all client application rulesTo view details of an aggregated client application rule To view aggregated client application rulesGeneral Policies General feature contains four policy categories Preset General policiesConfiguring the Client UI policy Configuring Enforce PoliciesTo change the policy setting Regular UserTo configure a Client UI policy Administrator UserCreating and applying a Client UI policy Disconnected User107 Setting passwordsTo create an administrator password Click the Advanced Options tab in the Client UI policy108 To create a time-based password Tray icon controlTo provide tray icon control of Windows UI Configuring the Trusted Networks policy To configure trusted network options110 Edit Select To do this AddRemove Include Local SubnetCreating and applying Trusted Applications policies Configuring the Trusted Applications policyTo create a new policy Trusted Application tab appearsTo create a trusted application Creating trusted applicationsEditing trusted applications To disable/enable a trusted applicationEnabling and disabling trusted applications Deleting trusted applicationsFine-tuning a deployment MaintenanceAnalyzing IPS events 115Working with client exception rules Creating exception rules and trusted application rulesCreating and applying new policies For details on working with client rules, seeTo view and reset broken inheritance below a specific node Policy maintenance and tasksPolicies tab Policy inheritance and assignmentClick Copy policy assignments To copy and paste policy assignments of a nodePolicy Catalog To view nodes where a policy is assignedViewing policy information To view all policies that have been createdTo view the settings and owner of a policy To view assignments where policy enforcement is disabledEditing policy information To edit a policy Directory Gateway Running server tasksEvent Archiver Property TranslatorSetting up notifications for events How notifications workCreating rules 124 Host Intrusion Prevention notificationsRunning reports Pre-defined reportsReport repository Host Intrusion Prevention reports Report content controlSummary information and details IPS Events Summary by SignatureIPS Event Summary by Target Network Intrusion Summary by Source IPSignature Top 10 Triggered Signatures Top 10 Attacked Nodes for IPSBlocked Application Summary Filters on platform and signature typeFailed Quarantine Updates Top 10 Blocked ApplicationsInitial View Drill Down Host Name To add update packages automatically Checking in the update packageUpdating From the Task type list, select Repository PullTo run an update task To add update packages manuallyTo have a client request an update Updating clientsWindows client Host Intrusion Prevention ClientSystem tray icon Client console133 Unlocking the client interface Setting optionsTo unlock the Host Intrusion Prevention interface To customize client optionsTroubleshooting Error ReportingShow tray icon Error Reporting Select For thisTo set IPS logging options To set Firewall logging optionsSecurity Violations Alerts Intrusion alerts137 Firewall alerts To respond to a firewall Learn Mode alert138 Has the Treat rule match as an intrusion option selectedApplication Blocking alerts Quarantine alerts Spoof Detected alerts„ The IP address that the traffic pretends to come from 140 IP Spoof Detected Alert dialog box 141IPS Policy options IPS Policy tabTo customize IPS Policy options 142Exception rules list IPS Policy exception rulesTo edit the exception rules 143Firewall Policy options Firewall Policy tabTo customize Firewall Policy options 144Firewall Policy Rules Firewall rules list145 Application Policy options Application Policy tabTo customize Application Policy options 146Application Policy rules Application rules list147 Blocked Hosts list Blocked Hosts tab148 Column What it showsTo edit the Blocked Hosts list 149Until removed Application Protection list Application Protection tabThis list shows all monitored processes on the client 150Activity Log options Activity Log tabTo customize Activity Log options 151152 Activity Log listSelect Create Sniffer Capture... McAfee Host Intrusion Prevention OptionsClient installation issues TroubleshootingSolaris client Policy enforcement with the Solaris clientRun this command To do this Client operations issues154 File/Directory Name DescriptionTo stop a Solaris client To restart a Solaris client155 Policy enforcement with the Linux client Linux clientFile Name Description Verifying the client is running158 Troubleshooting toolTo stop a Linux client Run the command hipts agent offTo restart a Linux client 159What is a policy? Frequently Asked QuestionsWhat is the McAfee Default policy? 160161 How do I create an exception based on an IPS Event? How do I view IPS events triggered by clients?How do I find existing policies that match a given profile? How do I create custom signatures for an IPS Policy?Rule Structure Writing Custom SignaturesBasic structure of a rule is the following 164Mandatory common sections 165Section Name Value Description Name/domain user name Use of Include and ExcludeOptional common sections Section value variablesUse of the dependencies section Use of environment variables Use of wildcardsUse of predefined variables Windows IIS Web ServerMS SQL Database Server Solaris Apache and iPlanet169 Windows Custom Signatures This topic describes how to write Windows custom signaturesClass Files 170171 GUI name Explanation Advanced DetailsClass Isapi Machine where the client is installed in the manner host Windows Custom Signatures Class Registry 177 Section Values Meaning/remarks Class ServicesGUI Name Explanation Possible Values Windows Custom Signatures Solaris Custom Signatures This topic describes how to write Solaris custom signaturesClass UNIXfile 181Directive File Source File permission New permission Relevant X directives per sectionAdvanced Details Class UNIXapache183 Solaris Custom Signatures 185 Linux Custom SignaturesList of parameters according to type Summary of parameters and directivesList of directives according to type 186187 GlossaryBlocked host 188Console tree 189EPolicy Orchestrator database server 190See also minimal properties 191Inactive agent 192Policy enforcement interval 193Severity level 194SYN flood 195Index Working with clients Signatures, 46 creating, 48 creating custom Firewall policy tab rules List IPS Policy tab Page Mcafee.com