Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Managing Your Protection
Management of information
You can produce queries for a group of selected client systems, or limit report results by product
or system criteria. You can export reports into a variety of file formats, including HTML and
Microsoft Excel.
Your options include:
• Setting a filter to gather only selected information. Choose which group or tags to include
in the report.
• Setting a data filter using logical operators, to define precise filters on the data returned by
the report.
• Generating graphical reports from the information in the database, and filter the reports as
needed. You can print the reports and export them to other software.
• Running queries of computers, events, and installations.
Predefined and custom queries to analyze your protection
The reporting feature contains predefined queries from Host Intrusion Prevention and allows
you to create custom queries.
You can organize and maintain these queries to suit your needs. For example, if you customize
settings for a report, you can export these settings as a template. You can also create custom
templates and organize templates in logical groupings. For example, you can group queries
that you run daily, weekly, and monthly.
After a report is generated, you view summary information, as determined by the filter, if any,
that you have set. From the summary information you can drill down to one or two levels for
detailed information, all in the same report.
You can control how much report information is visible to different users; for example, global
administrators versus other users. Some users can only view reports on systems in sites where
they have permissions. Report information is also controlled by applying filters.
Custom queries
You can create threeHost IPS queries with the Query Builder wizard: Application Blocking Client
Rules, Firewall Client Rules, and IPS Client Rules. Query parameters include:
Application Blocking Client Rules
Firewall Client Rules
IPS Client Rules
• Create Reaction
• Creation Date
• Creation Date
• Creation Date • Direction
• Enabled
• Enabled • Domain List
• Full Process Name
• Full Process Name
• Effective Reaction
• Include All Processes
• Hash • Enabled
• Include All signatures
• Hook Reaction • End Time
• Include All Users
• Local Version
• Full Process Name
• Last Modified Date
• Modified Date • Hash
• Local Version
• Process Eval Option • IP Protocol
• Process Name
• Process Name
• Local Service
• Process Path
• Process Path
• Local Service type
• Reaction
• Local Version
• Signature ID
• Log Status • User Name
• Match Intrusion
• Modified Date
14
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0