McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 34)

To use Expert method:To use Standard method:

signature. Before writing a rule, make sure you

understand rule syntax.

1 Type the rule syntax for the signatures, which

can include a name for the rule. Use ANSI format

and TCL syntax.

1 Enter a name for the signature and choose a

type.

2 Specify the operations that trigger the

signature. 2 Click OK and the rule is added to the list at the

top of the Subrule tab. The rule is compiled and

3 Indicate whether to include or exclude a

particular parameter, what the parameter is

and its value.

the syntax is verified. If the rule fails verification,

a dialog box describing the error appears. Fix the

error and verify the rule again.

4 Click OK and the rule is added to the list at the

top of the Subrule tab. The rule is compiled

and the syntax is verified. If the rule fails

verification, a dialog box describing the error

appears. Fix the error and verify the rule again.

5 Click OK.

NOTE: You can include multiple rules in a signature.

Creating signatures using the wizard

Use this task to creation a signature using a wizard. This is recommended if you are new to

creating signatures. Note that signatures created with the wizard do not offer any flexibility for

the operations the signature is protecting because you cannot change, add, or delete operations.

Task

For option definitions, click ? on the page displaying the options.

1 On the IPS Rules Signatures tab, click Add Signature Wizard.

2 On the Basic Information tab, enter a name and select the platform, severity level. log

status, and whether to allow the creation of client rules. Click Next to continue.

Figure 7: Signature Creation Wizard— Basic Information

3 On the Description tab, type a description of what the signature is protecting. This

description appears in the IPS Event when the signature is triggered.

Configuring IPS Policies

Working with IPS Rules policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.034

1 2 ... 29 30 31 32 33 34 35 36 37 38 39 ... 111 112

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 34