Product GuideMcAfee MOVE AntiVirus 3.0.0For use with ePolicy Orchestrator 4.6.0, 5.0.0 Software

SVA requirementsYou must use the virtual machine we provide. This is a dedicated virtual appliance with VirusScanEnterprise for Linux installed.The Op

• McAfee MOVE AV Agentless multiple OVF deployment tool (MOVE‑AV‑AL_DeploySVA_3.0.0.zip)• McAfee MOVE AV Agentless ePolicy Orchestrator package (MOVE‑

Setting up the SVAYou must deploy the OVF and configure the SVA before you can begin using the Agentless deploymentoption.OVF deployment optionsThe pr

TaskFor option definitions, click ? in the interface.1Gather this information, which you'll need when you run the configuration script:SVA IP add

Column Header OVF PropertyePO Server NetworkThe name of the ESXi network that is used by the McAfee ePO serverto manage the McAfee SVA.To successfully

2Apply these settings to deploy the OVF:For this option... Do this...SourceBrowse to and select move‑sva.ovf file.OVF Template DetailsReview details a

1Log on to the SVA using the root or administrator account.2Run this command:sudo date ‑s "16 APR 2012 16:05:00"In this example the DATE and

OVF propertiesIf you manually deploy the OVF from the vSphere Client, the Properties page contains these settings. Ifthese settings are specified duri

Install the McAfee MOVE AV Agentless extensionA product's extension must be installed before ePolicy Orchestrator can manage the product.Before y

3Monitoring and managingThe Agentless deployment option monitors the status of virtual desktops and modifies behavior fromthe ePolicy Orchestrator con

COPYRIGHTCopyright © 2013 McAfee, Inc. Do not copy without permission.TRADEMARK ATTRIBUTIONSMcAfee, the McAfee logo, McAfee Active Protection, McAfee

Policies and their categoriesPolicy information is grouped into two categories: SVA and Scan. You can create, modify, or delete asmany policies as nee

7In the Scan Settings tab, configure these settings to control which files are scanned.Increasing the Cache scan result of file size up to (MB) might

Apply a policyYou must apply a policy for it to take effect. You can apply McAfee MOVE AV Agentless Scan policy toindividual virtual machine, group, o

How quarantine worksMcAfee MOVE AV Agentless implements a remote quarantine system, where quarantined files arestored on an administrator‑specified ne

3View the VMs corresponding to the selected file.4Save a file to your local system.5Restore a specific file to one or more selected VMs.Restore a file

The RestoreTool.log is where errors are logged.Enabling the scan policy quarantine configurationThe Quarantine tab is located on the Scan policy page.

Configure the quarantine folderYou can limit access to the quarantine folder by configuring permissions.Tasks• Set permissions for shared folders on p

• Quarantine folder• Domain User Account — The account used by the SVA to quarantine files.• Domain Local Security Group — This group has access to th

How VM-based scan configuration worksUsing the VM‑based scan configuration setting, the McAfee ePO administrator can enforce unique scanpolicies to di

Monitoring the SVAMonitor the status of the SVA using the Threat Event Log in ePolicy Orchestrator, or the Health andAlarms feature in VMware vShield

ContentsPreface 5About this guide ... 5Audience ... 5Conventions ...

To create reports, your assigned permission set must include the ability to create and edit reports. Youcan restrict access to reports using groups an

4Upgrade McAfee MOVE AV AgentlessThere are two approaches for upgrading McAfee MOVE AV Agentless, you can deploy a new SVA orupgrade an existing SVA.

TaskFor option definitions, click ? in the interface.1From the ePolicy Orchestrator console, click Menu | Software | Extensions.2When the Extensions p

6Power off the SVA.Do not delete this SVA until the 3.0 version is successfully deployed. This SVA can be used to helptroubleshoot deployment issues.7

3Select the package type as Product or Update (.zip).4Browse to and select the MOVEAVAgentless.3.0.0.163‑SVA file.5Click Next.6On the Package Options

TaskFor option definitions, click ? in the interface.1Click Menu | Policy | Client Task Assignments, then click the Assigned Client Tasks tab.2Click A

4Upgrade McAfee MOVE AV AgentlessAssign a policy36McAfee MOVE AntiVirus 3.0.0 Product Guide

SVA security requirementsThe following security measures are implemented on the SVA.SecuritymeasureDescriptionapparmorapparmor is a kernel module that

SVA security requirements38McAfee MOVE AntiVirus 3.0.0 Product Guide

IndexAabout this guide 5Agentless deployment optioninstall extension 18integration with ePolicy Orchestrator 19policy management 19Ccomponentsdefined

Create a product deployment task ... 34Assign a product deployment task ...34Assign a policy ...

security virtual appliance (continued)manually configure 16monitoring 29view status 29ServicePortal, finding product documentation 6TTechnical Support

00

PrefaceContents About this guide Find product documentationAbout this guideThis information describes the guide's target audience, the typo

Find product documentationMcAfee provides the information you need during each phase of product implementation, frominstallation to daily use and trou

1Introduction to McAfee® MOVE AntiVirusAgentlessMcAfee® MOVE AntiVirus Agentless provides virus protection for virtual machines (VMs) and contains aSe

File Quarantine — Remote quarantine system, where quarantined files are stored on anadministrator‑specified network share.GTI (Global Threat Intellige

2Installation and configurationTo set up your environment for McAfee MOVE AV Agentless, you install VMware vShield Endpoint,configure the Security Vir