Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring General Policies
Working with Trusted Applications policies
Task
For option definitions, click ? on the page displaying the options.
1 Go to Systems | Policy Catalog and select Host Intrusion Prevention: General in
the Product list and Trusted Networks in the Category list. The list of policies appears.
2 In the Trusted Networks policy list, click Edit under Actions to change the settings for
a custom policy.
Figure 33: Trusted Networks
3 Do any of the following:
Select...
Include Local Subnet Automatically
Trusted Network
Trust for network IPS
Add/Remove button
To do this...
Automatically treat all users on the same subnet as trusted, even those
not in the list.
Add a trusted network address to the list.
Mark the network as trusted for network IPS signatures.
Remove or add a trusted network address.
4 Click Save to save changes.
Working with Trusted Applications policies
The Trusted Applications policy enables you to create a list of trusted applications. Enforce one
or more policies with these application settings to reduce or eliminate most false positives.
You can assign more than one policy instance of this policy, which allows for a more detailed
profile of trusted application usage.
In tuning a deployment, creating IPS exception rules is one way to reduce false positives. This
is not always practical when dealing with several thousand clients or having limited time and
resources. A better solution is to create a list of trusted applications, which are applications
known to be safe in a particular environment. For example, when you run a backup application,
many false positive events can be triggered. To avoid this, make the backup application a trusted
application.
NOTE: A trusted application is susceptible to common vulnerabilities such as buffer overflow
and illegal use. Therefore, a trusted application is still monitored and can trigger events to
prevent exploits.
This policy category contains a preconfigured policy, which provides a list of specific McAfee
applications and Windows processes. You can view and duplicate the preconfigured policy; you
can edit, rename, duplicate, delete, and export custom policies you create.
On the Policy Catalog policy list page, click New Policy to create a new custom policy; click
Duplicate under Actions to create a new custom policy based on an existing policy.
82
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0