Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring Application Blocking Policies
Working with Application Blocking Rules policies
1 Go to Systems | Policy Catalog and select Host Intrusion Prevention: Application
Blocking in the Product list and Application Blocking Options in the Category list.
The list of policies appears.
2 In the Application Blocking Options policy list, click Edit under Actions to change the
settings for a custom policy.
Figure 26: Application Blocking Options
3 In the Application Blocking Options page that appears, make any needed changes,
then click Save.
Working with Application Blocking Rules policies
Application blocking rules determine whether specific applications are blocked from running,
hooking, or both. Apply application blocking rules only after having run in adaptive or learn
mode to determine which applications are present and perhaps vulnerable in your environment.
You should examine all learned rules before moving them to a policy. Use application blocking
rules only after a set period of over all policy fine-tuning. If applications change regularly,
application blocking is not recommended; however, if your environment has a fairly fixed set
of applications, this feature can add another layer of security without additional administrative
work.
This policy category contains a single default policy, which provides application blocking for
McAfee and general Windows applications, and an editable My Default policy. You can view
and duplicate the preconfigured policy as wall as copy selected rules in it to another policy; you
can edit, rename, duplicate, delete, and export custom policies.
Within the policy you can add, edit, duplicate, or delete rules. You can also move rules up or
down in the list or to another policy.
On the Policy Catalog policy list page, click New Policy to create a new custom policy; click
Duplicate under Actions to create a new custom policy based on an existing policy.
Change the policy’s assignment on the Policy Assignment page. For a group, go to Systems
| System Tree, select a group, and then on the Policies tab click Edit Assignment.. For a
system go to Systems | System Tree, select a group that contains the system, and then on
the System tab, select the system and select More Actions | Modify Policies on a Single
System.
Tasks
Configuring an Application Blocking Rules policy
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
71