Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Working with IPS Rules policies
Tasks
Configuring IPS Rules application protection rules
Creating application protection rules
Configuring IPS Rules application protection rules
Use this task to create, view, edit, or delete application protection rules and move application
protection rules to another policy.
Task
For option definitions, click ? on the page displaying the options.
1 On the Policy Catalog page, select Host Intrusion Prevention: IPS on the Product list
and select IPS Rules on the Category list. The list of policies appears.
2 Under Actions, click Edit to make changes on the IPS Rules page, then click the
Signatures tab.
3 Use the filters at the top of the list to filter the view of all application protection rules in
the policy. You can filter on rule status, inclusion, or specific text that includes process
name, process path, or computer name. Click Clear to remove filter settings.
Figure 10: IPS Rules—Application Protection Rules
4 Under Actions, click Edit for the rule you want to modify. Click OK to save changes.
5 Click Add Application to add a new rule to the list.
6 Under Actions, click Delete for the rule you want to delete.
7 Select a rule and click Copy To to move it to another policy. Indicate the policy to which
to move the rule and click OK.
NOTE: You can move several rules at one time by selecting all the rule before clicking Copy
To.
8 Click Save to save changes.
Creating application protection rules
Use this task to create application protection rules.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
37