Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Working with Host Intrusion Prevention Clients
Overview of the Windows client
Host Intrusion Prevention creates a new firewall rule based on the options selected, adds
it to the Firewall Rules list, and automatically allows or blocks similar traffic.
Responding to Application Blocking alerts
When application creation or application hooking is enabled in the Application Blocking
Options policy, Host Intrusion Prevention monitors application activities and allows or blocks
them based on the rules in the Application Blocking Rules policy.
If you enabled learn mode for either creation blocking or hooking blocking, Host Intrusion
Prevention displays an Application Creation Alert or Application Hook Alert whenever it
detects an unknown application trying to run or bind to another program.
The Application Information tab displays information about the application attempting to
run (creation) or to hook (hook) to another process, including application name, path, and
version.
Use this dialog box to select an action:
• Click Allow to let the application complete its action:
• For an Application Creation Alert, clicking Allow lets the application run.
• For an Application Hook Alert, clicking Allow lets the application bind itself to another
program.
• Click Deny to block the application:
• For an Application Creation Alert, clicking Deny prevents the application from running.
• For an Application Hook Alert, clicking Deny blocks the application from binding itself to
another program.
When you click Allow or Deny, Host Intrusion Prevention creates a new application rule based
on your choice. After collecting client properties, this rule is added to the Application Client
Rule tab of the Application Rules policy. The application is then allowed or blocked
automatically.
Responding to Quarantine alerts
If you enable Quarantine mode and include the IP address of the client for quarantine
enforcement in the Quarantine Options policy, a quarantine alert appears in the following
situations:
• Changing the client computer’s IP address
• Disconnecting and then reconnecting the client Ethernet connection
• Restarting the client
Responding to Spoof Detected alerts
If you enable the IPS feature, this alert automatically appears if Host Intrusion Prevention
detects an application on your computer sending out spoofed network traffic. This means that
the application is trying to make it seem like traffic from your computer actually comes from a
different computer. It does this by changing the IP address in the outgoing packets. Spoofing
92
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0