Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

More documents

Recommendations

Info

Working with Host Intrusion Prevention Clients The Host Intrusion Prevention client can be installed on Windows, Solaris, and Linux platforms. Only the Windows client has an interface, but all versions have troubleshooting functionality. This section describes the basic features of each client version. Overview of the Windows client Overview of the Solaris client Overview of the Linux client Overview of the Windows client Direct client-side management of the Host Intrusion Prevention Windows client is available through a client interface. To display the client console, double-click the client icon in the system tray, or, on the Start menu, select Programs | McAfee | Host Intrusion Prevention. When the client console first appears, most options are locked; you can only view current settings and manually create client rules (if the Client UI policy has manual creation of client rules enabled). For complete control of all settings in the console, unlock the interface with a password. For details on these Client UI policy settings, see Configuring the Client UI policy. System tray icon If the Host Intrusion Prevention icon appears in the system tray, it provides access to the client console and indicates the status of the client. Icon Host Intrusion Prevention status Working properly A potential attack was detected Turned off, or not working properly A description of the status appears when you place the mouse pointer over the icon. Right-click the icon to access the shortcut menu: Click... Configure To do this... Open the Host Intrusion Prevention client console. 86 McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
Working with Host Intrusion Prevention Clients Overview of the Windows client Click... About... To do this... Open the About Host Intrusion Prevention dialog box, which displays the version number and other product information. If the Allow disabling of features from the tray icon option is applied to the client, some or all of these additional commands are available: Click... Restore Settings Disable All Disable IPS Disable Firewall Disable App Blocking To do this... Enable all disabled features. Available only if one or more features have been disabled. Disable IPS, Firewall, Application Blocking features. Available only if all the features are enabled. Disable the IPS feature. This includes both Host IPS and Network IPS functionality. Available only if the feature is enabled. Disable the Firewall feature. Available only if the feature is enabled. Disable the Application Blocking feature. This includes both Application Creation Blocking and Application Hooking Blocking. Available only if the feature is enabled. Client console for Windows clients The Host Intrusion Prevention client console gives you access to several configuration options. To open the console, do one of the following: • Double-click the icon in the system tray. • Right-click the icon and select Configure. • On the Start menu select Programs | McAfee | Host Intrusion Prevention. The console lets you configure and view information about Host Intrusion Prevention features. It contains several tabs, which correspond to a specific Host Intrusion Prevention feature. Unlocking the Windows client interface An administrator remotely managing Host Intrusion Prevention using ePolicy Orchestrator can password protect the interface to prevent accidental changes. With a time-based password, an administrator or user can temporarily unlock the interface and make changes. Task 1 Obtain a password from the Host Intrusion Prevention administrator. NOTE: For details on creating a password, see Configuring Client UI passwords. 2 On the Task menu, select Unlock User Interface. 3 In the Login dialog box, type the password and click OK. Setting client UI options The Host Intrusion Prevention client console provides access to some settings delivered by the Client UI policy, and enables you to customize these settings for the individual client. McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0 87
Page 1 and 2:
McAfee Host Intrusion Prevention 7.
Page 3 and 4:
Contents Introducing Host Intrusion
Page 5 and 6:
Contents Creating firewall rule gro
Page 7 and 8:
Introducing Host Intrusion Preventi
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Managing Your Protection Management
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Configuring IPS Policies Overview o
Page 27 and 28:
Configuring IPS Policies Working wi
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36: Configuring IPS Policies Working wi
Page 45 and 46: Configuring Firewall Policies The F
Page 47 and 48: Configuring Firewall Policies Overv
Page 57 and 58: Configuring Firewall Policies Worki
Page 69 and 70: Configuring Application Blocking Po
Page 77 and 78: Configuring General Policies Workin
Page 85: Configuring General Policies Workin
Page 89 and 90: Working with Host Intrusion Prevent
Page 107 and 108: Index clients (continued) updating
Page 109 and 110: Index McAfee Default policy (contin
Page 111 and 112: Index T troubleshooting, Host IPS C
show all

Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Create successful ePaper yourself

Delete template?

Save as template?