Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Working with IPS Rules policies
To use Standard method:
To use Expert method:
signature. Before writing a rule, make sure you
understand rule syntax.
1 Enter a name for the signature and choose a
type.
1 Type the rule syntax for the signatures, which
can include a name for the rule. Use ANSI format
and TCL syntax.
2 Specify the operations that trigger the
signature. 2 Click OK and the rule is added to the list at the
top of the Subrule tab. The rule is compiled and
3 Indicate whether to include or exclude a
particular parameter, what the parameter is
and its value.
4 Click OK and the rule is added to the list at the
top of the Subrule tab. The rule is compiled
and the syntax is verified. If the rule fails
verification, a dialog box describing the error
appears. Fix the error and verify the rule again.
the syntax is verified. If the rule fails verification,
a dialog box describing the error appears. Fix the
error and verify the rule again.
5 Click OK.
NOTE: You can include multiple rules in a signature.
Creating signatures using the wizard
Use this task to creation a signature using a wizard. This is recommended if you are new to
creating signatures. Note that signatures created with the wizard do not offer any flexibility for
the operations the signature is protecting because you cannot change, add, or delete operations.
Task
For option definitions, click ? on the page displaying the options.
1 On the IPS Rules Signatures tab, click Add Signature Wizard.
2 On the Basic Information tab, enter a name and select the platform, severity level. log
status, and whether to allow the creation of client rules. Click Next to continue.
Figure 7: Signature Creation Wizard— Basic Information
3 On the Description tab, type a description of what the signature is protecting. This
description appears in the IPS Event when the signature is triggered.
34
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0