McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 38)

Task

For option definitions, click ? on the page displaying the options.

1 On the IPS Rule policy Application Protection Rules tab, do one of the following:

• Click Add Application Rule. A blank Application Protection Rule page appears.

• Select a rule and click Duplicate. After naming and saving the new rule, click Edit.

2 Enter the name, status, whether the application rule is included in the protection list, and

the processes to which you want to apply the rule.

Figure 11: Application Protection Rule

3 Click OK.

Working with IPS Exceptions

Sometimes behavior that would be interpreted as an attack can be a normal part of a user’s

work routine. This is called a

false positive alert

. To prevent false positives, create an exception

for that behavior.

Exceptions enable you to reduce false positive alerts, minimizes needless data flowing to the

console, and ensures that the alerts are legitimate security threats.

For example, during the process of testing clients, a client recognizes the Outlook Envelope

- Suspicious Executable Mod. signature. This signature signals that the Outlook e-mail

application is attempting to modify an application outside the envelope of usual resources for

Outlook. Thus, an event triggered by this signature is cause for alarm, because Outlook may

be modifying an application not normally associated with email, for example, Notepad.exe.

In this instance, you might reasonably suspect that a Trojan horse has been planted. But, if

the process initiating the event is normally responsible for sending email, for example, saving

a file with Outlook.exe, you need to create an exception that allows this action.

Tasks

Configuring IPS Rules exceptions

Creating exception rules

Configuring IPS Policies

Working with IPS Rules policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.038

1 2 ... 33 34 35 36 37 38 39 40 41 42 43 ... 111 112

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 38