Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring IPS Policies
Working with IPS Rules policies
Configuring IPS Rules exceptions
Use this task to create, view, edit, or delete exception rules and move exception rules to another
policy
Task
For option definitions, click ? on the page displaying the options.
1 On the Policy Catalog page, select Host Intrusion Prevention: IPS on the Product list
and select IPS Rules on the Category list. The list of policies appears.
2 Under Actions, click Edit to make changes on the IPS Rules page, then click the
Exception Rules tab.
3 Use the filters at the top of the list to filter the view of all exception rules in the policy. You
can filter on rule status, modified date, or specific text that includes rule or notes text. Click
Clear to remove filter settings.
Figure 12: IPS Rules—Application Protection Rules
4 Under Actions, click Edit for the rule you want to modify. Click OK to save changes.
5 Click Add Exception to add a new rule to the list.
6 Under Actions, click Delete for the rule you want to delete.
7 Select a rule and click Copy To to move it to another policy. Indicate the policy to which
to move the rule and click OK.
NOTE: You can move several rules at one time by selecting all the rules before clicking
Copy To.
8 Click Save to save changes.
Creating exception rules
Use this task to create exception rules. When creating an exception rule, you need to define
the exception and indicate the signature to which the exception applies.
Task
For option definitions, click ? on the page displaying the options.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
39