Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Introducing Host Intrusion Prevention 7.0
McAfee Host Intrusion Prevention is a host-based intrusion detection and prevention system
that protects system resources and applications from external and internal attacks. It delivers
a manageable and scalable intrusion prevention solution for workstations, notebooks, and critical
servers, including web and database servers. It proactively blocks zero-day and known attacks
with patented technology.
Host Intrusion Prevention protects against unauthorized viewing, copying, modifying, and
deleting of information and the compromising of system and network resources and applications
that store and deliver information. It accomplishes this through a combination of behavioral
rules, host and network signatures, and a system firewall to block attacks and reduce the
urgency of patches for new threats.
As soon as Host Intrusion Prevention is installed, you are protected. The default settings allow
for a rapid, large-scale deployment. For greater protection, you can apply stricter preset or
custom policies.
Host Intrusion Prevention is fully integrated with ePolicy Orchestrator and uses the ePolicy
Orchestrator framework for delivering and enforcing policies. This approach provides a single
management solution that allows for mass deployment — up to 100,000 systems — in multiple
languages across an entire enterprise for true global coverage.
Host Intrusion Prevention functionality is divided into IPS, Firewall, Application Blocking, and
General features to provide greater control in delivering protection to users.
Contents
Host Intrusion Prevention protection
Types of Host Intrusion Prevention policies
Policy management
Policy tracking and tuning
Host Intrusion Prevention protection
As soon as the Host Intrusion Prevention client is installed, intrusion prevention protection is
in effect. Communication with the ePO server is required for monitoring and policy and content
updates.
ePolicy Orchestrator communicates policy information to Host Intrusion Prevention clients on
a regular interval through the ePolicy Orchestrator agent. Host Intrusion Prevention clients
enforce the policies, collect event information, and transmit the information back to ePolicy
Orchestrator. Client-side management is available through a client console for Windows clients
and a troubleshooting utility for non-Windows clients, where you monitor and change protection,
including turning features on and off, manually creating client rules, and viewing logs.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
7