Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Managing Your Protection
Management of policies
To...
Delete a policy
Assign a policy owner
Export a policy
Export all policies
Import policies
Do this...
Click Delete (not available for default or preconfigured policies).
NOTE: When you delete a policy, all groups to which it is currently applied
inherit the policy of this category from their parent. Before deleting a policy,
look at all of the nodes to which it is assigned, and assign a different policy
if you don’t want the policy to inherit from the parent. If you delete a policy
that is applied at the top level, the default policy of this category is applied.
Click the owner of the policy and select another owner from a list (not available
for default or preconfigured policies).
Click Export, then name and save the policy (an XML file) to the desired
location.
Click Export all policies, then name and save the policy XML file to the
desired location.
Click Import at the top of the Policy Catalog page, select the policy XML file,
then click OK.
For details on any of these features, refer to the ePolicy Orchestrator 4.0 documentation.
Configuring polices
After you install the Host Intrusion Prevention software, McAfee recommends that you configure
policies to provide the greatest amount of security while not conflicting with day-to-day activities.
The default policies in Host Intrusion Prevention fit the broadest set of customer environments
and may meet your needs. To tune policies to fit your particular setting, we recommend the
following:
• Carefully define your Host Intrusion Prevention security configuration. Evaluate who is
responsible for configuring particular parts of the system and grant them appropriate
permissions.
• Change the default IPS Protection or Firewall Rules policies, which provide increasing levels
of preset protection.
• Modify severity levels of specific signatures. For example, when a signature is triggered by
day-to-day work of users, adjust the severity level to a lower level.
• Configure dashboards for a quick overview of compliance and issues.
• Configure notifications to alert specific individuals when particular events occur. For example,
a notification can be sent when an activity that triggers a High severity event occurs on a
particular server.
Clients and planning your deployment
Host IPS clients are the element that provide protection in a Host Intrusion Prevention
deployment. Ideally, every system in a working environment is protected by client software.
McAfee recommends a phased approach to deployment:
• Determine your initial client rollout plan. Although you will deploy Host Intrusion
Prevention clients to every host (servers, desktops, and laptops) in your company, McAfee
recommends that you start by installing clients on a limited number of representative systems
and tuning their configuration. After you have fine-tuned the deployment, you can then
deploy more clients and leverage the policies, exceptions, and client rules created in the
initial rollout.
18
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0