Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Managing Your Protection
Management of systems
1 Describe the rule.
2 Set filters for the rule.
3 Set thresholds for the rule.
4 Create the message to be sent and the type of delivery.
Notification categories
Host Intrusion Prevention supports the following product-specific notification categories:
• Host Intrusion detected and handled
• Network Intrusion detected and handled
• Application blocked
• Quarantined computer update failed
• Unknown
Notifications can be configured for all or none of the Host (or Network) IPS signatures. Host
Intrusion Prevention supports the specification of a single IPS signature ID as the threat or rule
name in the notification rule configuration. By internally mapping the signature ID attribute of
an event to the threat name, a rule is created to uniquely identify an IPS signature.
The specific mappings of Host Intrusion Prevention parameters allowed in the subject/body of
a message include:
Parameters
Host and Network IPS
Events Values
Blocked Application
Event Values
Quarantine Event Values
Actual threat or rule names
SignatureID
none
none
Source systems
Remote IP address
computer name
computer name
Affected objects
Process Name
Application name
IP address of computer
Time notification sent
Incident time
Incident time
Incident time
Event IDs
ePO mapping of event ID
ePO mapping of event ID
ePO mapping of event ID
AdditionalInformation
Localized Signature Name
(from client computer)
Application full path
none
Host IPS protection updates
Host Intrusion Prevention supports multiple versions of client content and code, with the latest
available content appearing in the ePO console. New content is always supported in subsequent
versions, so content updates contain mostly new information or minor modifications to existing
information.
Updates are handled by a content update package. This package contains content version
information and updating scripts. Upon check-in, the package version is compared to the version
of the most recent content information in the database. If the package is newer, the scripts
from this package are extracted and executed. This new content information is then passed to
clients at the next agent-server communication.
NOTE: Host Intrusion Prevention content updates must be checked into the ePO master
repository for distribution to clients. Host Intrusion Prevention clients obtain updates only
through communication with the ePO server, and not directly through FTP or HTTP protocols.
The basic process includes checking in the update package to the ePO master repository, then
sending the updated information to the clients.
22
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0