Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Working with IPS Protection policies
2 In the IPS Options policy list, click Edit under Actions to change the settings for a custom
policy.
Figure 2: IPS Options
3 In the IPS Options page that appears, make any needed changes, then click Save.
Working with IPS Protection policies
The IPS Protection policy sets the protective reaction for signature severity levels. These settings
instruct clients what to do when an attack or suspicious behavior is detected. Each signature
has one of four severity levels:
• High — Signatures of clearly identifiable security threats or malicious actions. These
signatures are specific to well-identified exploits and are mostly non-behavioral in nature.
Prevent these signatures on every system.
• Medium — Signatures of behavioral activity where applications operate outside their
envelope. Prevent these signatures on critical systems, as well as on web servers and SQL
servers.
• Low — Signatures of behavioral activity where applications and system resources are locked
and cannot be changed. Preventing these signatures increases the security of the underlying
system, but additional fine-tuning is needed.
• Information — Signatures of behavioral activity where applications and system resources
are modified and might indicate a benign security risk or an attempt to access sensitive
system information. Events at this level occur during normal system activity and generally
are not evidence of an attack.
These levels indicate potential danger to a system and enable you to define specific reactions
for different levels of potential harm. You can modify the severity levels and reactions for all
signatures. For example, when suspicious activity is unlikely to cause damage, you can select
ignore as the reaction. When an activity is likely to be dangerous, you can set prevent as the
reaction.
This policy category contains six preconfigured policies and an editable My Default policy. You
can view and duplicate preconfigured policies; you can, create, edit, rename, duplicate, delete,
and export custom policies.
Preconfigured policies include:
Basic Protection (McAfee Default)
• Prevent high severity level signatures and ignore the rest.
Enhanced Protection
28
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0