Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring Application Blocking Policies
Working with Application Blocking policies
Filtering and aggregating rules
Applying filters generates a list of rules that satisfies all of the variables defined in the filter
criteria. The result is a list of rules that includes all of the criteria. Aggregating rules generates
a list of rules grouped by the value associated with each of the variables selected in the Select
columns to aggregate dialog box. The result is a list of rules displayed in groups and sorted
by the value associated with the selected variables.
Working with Application Blocking policies
The Application Blocking Options policy turns on and off application blocking rules and allows
you to apply adaptive or learn mode to create new rules.
This policy category contains four preconfigured policies and an editable My Default policy.
You can view and duplicate preconfigured policies; you can, create, edit, rename, duplicate,
delete, and export editable custom policies.
Preconfigured policies include:
Off (McAfee Default)
All settings are disabled
On
• Application Creation Blocking, Regular Protection. (Only follows rules in rules list.)
• Application Hooking Blocking, Regular Protection. (Only follows rules in rules list.)
Adaptive
• Application Creation Blocking, Adaptive mode, (Rules are learned automatically.)
• Application Hooking Blocking, Adaptive mode, (Rules are learned automatically.
Learn
• Application Creation Blocking, Learn mode. (Rules are learned after user interaction.)
• Application Hooking Blocking, Learn mode. (Rules are learned after user interaction.)
On the Policy Catalog policy list page, click New Policy to create a new custom policy; click
Duplicate under Actions to create a new custom policy based on an existing policy.
Change the policy’s assignment on the Policy Assignment page. For a group, go to Systems
| System Tree, select a group, and then on the Policies tab click Edit Assignment. For a
system go to Systems | System Tree, select a group that contains the system, and then on
the System tab, select the system and select More Actions | Modify Policies on a Single
System.
Tasks
Configuring an Application Blocking Options policy
Configuring an Application Blocking Options policy
Use this task to enable or disable application blocking rules and apply adaptive or learn mode.
Task
For option definitions, click ? on the page displaying the options.
70
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0