McAfee UTILITIES 4.0 Betriebsanweisung PDF herunterladen (Seite 40)

1 On the IPS Rule policy Exception Rules tab, click Add Exception.

2 Enter the required data on each tab of the Exception wizard. These include: Signatures,

Users, Processes, Advanced Details and General tab. The Summary tab displays the

settings made in the previous tabs.

Figure 13: IPS Exception

3 Click Save.

Working with IPS events

An IPS event is triggered when a security violation, as defined by a signature, is detected. For

example, Host Intrusion Prevention compares the start of any application against a signature

for that operation, which may represent an attack. If a match occurs, an event is generated.

When Host Intrusion Prevention recognizes an IPS event, it flags it on the Host IPS Events tab

under Reporting with one of four severity level criteria: High, Medium, Low, and Information.

NOTE: When two events are triggered by the same operation, the highest signature reaction

is taken.

From the list of events generated, you can determine which events are allowable and which

indicate suspicious behavior. To allow events, configure the system with the following:

• Exceptions — rules that override a signature rule.

• Trusted Applications — applications that are labeled trusted whose operations may

otherwise be blocked by a signature.

This tuning process keeps the events that appear to a minimum, providing more time for analysis

of the serious events that occur.

Reacting to events

Under certain circumstances, behavior that is interpreted as an attack can be a normal part of

a user’s work routine. When this occurs, you can create an exception rule or a trusted application

rule for that behavior.

Creating exceptions and trusted applications allows you to diminish false positive alerts, and

ensures that the notifications you receive are meaningful.

For example, when testing clients, you may find clients recognizing the signature E-mail access.

Typically, an event triggered by this signature is cause for alarm. Hackers may install Trojan

Configuring IPS Policies

Working with IPS Rules policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.040

1 2 ... 35 36 37 38 39 40 41 42 43 44 45 ... 111 112

Keine Kommentare

McAfee UTILITIES 4.0 Betriebsanweisung Seite 40