Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Working with IPS Rules policies
Configuring IPS Rules signatures
Use this task to edit default signatures; create, edit or delete custom signatures; and move
signatures to another policy.
Task
For option definitions, click ? on the page displaying the options.
1 On the Policy Catalog page, select Host Intrusion Prevention: IPS on the Product list
and select IPS Rules on the Category list. The list of policies appears.
2 Under Actions, click Edit to make changes on the IPS Rules page, then click the
Signatures tab.
3 Use the filters at the top of the signatures list to filter the view of all signatures in the
policy. You can filter on signature severity, type, platform, log status, whether client rules
are allowed, or specific text that includes signatures’ name, notes, or content version. Click
Clear to remove filter settings.
Figure 4: IPS Signatures tab
4 Under Actions, click Edit for the signature you want to modify.
• If the signature is a default signature, modify the Severity Level, Client Rules, or
Log Status settings, and enter notes in the Note box to document the change. Click
OK to save any modifications. Edited default signatures can be reverted their default
settings by clicking Revert under Actions.
• If the signature is a custom signature, modify the Severity Level, Client Rules, Log
Status or Description settings, and enter notes in the Note box to document the
change. Click OK to save any modifications.
5 Click Add Signature or Add Signature Wizard to add a new signature to the list.
6 Under Actions, click Delete for the custom signature you want to delete.
NOTE: Only custom signatures can be deleted.
7 Select a signature and click Copy To to move it to another policy. Indicate the policy to
which to move the signature and click OK.
NOTE: You can move several signatures at one time by selecting all the signatures before
clicking Copy To.
32
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0