Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring General Policies
Working with Trusted Network policies
To
Turn on IPS logging
Include security violations in the IPS log
Turn engines on and off
Do this...
Select from the list the message type to trigger logging of IPS
events. Debug logs all messages; Information logs Information,
Warning, and Error messages; Warning logs Warning and Error
messages; Error logs error messages; Disabled logs no messages.
The path of the log file on Windows clients is: C:\Documents and
Settings\All Users\Application Data\McAfee\Host Intrusion
Prevention\HipShield.log; on Windows Vista: C:\Program
Data\McAfee\Host Intrusion Prevention\HipShield.log
Select Log security violations.
Deselect the checkbox to disable, select a checkbox to enable an
engine
NOTE: For details on working with the HIP client directly, see Working with Host Intrusion
Prevention Clients.
Working with Trusted Network policies
The Trusted Networks policy enables you to maintain a list of network addresses and subnets,
which you can tag as trusted for clients on Windows.
This policy category contains a preconfigured policy, which includes local subnets automatically
but lists no network addresses, and an editable My Default policy. You can view and duplicate
the preconfigured policy; you can create, edit, rename, duplicate, delete, and export editable
custom policies.
On the Policy Catalog policy list page, click New Policy to create a new custom policy; click
Duplicate under Actions to create a new custom policy based on an existing policy.
Change the policy’s assignment on the Policy Assignment page. For a group, go to Systems
| System Tree, select a group, and then on the Policies tab click Edit Assignment.. For a
system go to Systems | System Tree, select a group that contains the system, and then on
the System tab, select the system and select More Actions | Modify Policies on a Single
System.
Tasks
Configuring a Trusted Networks policy
Configuring a Trusted Networks policy
Trusted Networks enable you to maintain a list of network addresses and subnets that you can
tag as trusted for clients on Windows. You can:
• Set up trusted network options.
• Add or delete addresses or subnets in the trusted list.
NOTE: If one trusted network trusts a specific IP address for network IPS and another trusted
network does not trust the same IP address for network IPS, like firewall rules, the entry listed
first takes precedence.
Use this task to set trusted network options and list trusted networks.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
81