McAfee QUICKCLEAN 1.0 Manual de usuario descargar pdf (Pagina 22)

Responding to events

Use the information on the TIE module for VSE Events page to adjust file and certificate reputations to

prevent threats and other events.

When you drill down into recent events on the Events page, you can see the items that are generating

events. If you see a file or certificate that's causing a block or prompt based on its reputation, you can

change its reputation setting to stop the event. Select the file to see its details, then use the options

on the Actions menu to change its reputation.

Setting a system's health status

Based on the threat events reported and files executed on a system, you can set it's health status to

see compromised systems and healthy systems.

As events are reported and files are blocked or allowed, you can set the health status of specific

systems. You can then monitor compromised systems for threat events, or change policy settings for

systems that have run, or often block, malicious or suspicious files.

There are three system health settings: Compromised, Healthy, and Possibly Compromised. You can manually

set the health status for particular systems using Threat Intelligence Exchange, or create an Automatic

Response query or Server Task in McAfee ePO to apply a status automatically. You can then create a

query that looks for compromised systems and run a server task to take a specific action on those

systems.

When creating the Automatic Response in McAfee ePO, the system health status options on are the

Actions page of the wizard. Choose the Run System Command action, and from the System command

drop-down, choose Set System Health Indicator and specify the health status.

For details about creating Automatic Responses, queries, and server tasks, see the McAfee ePolicy

Orchestrator Best Practices Guide.

Set system health status

Manually set the Threat Intelligence Exchange health status for systems to indicate if it's healthy,

compromised, or potentially compromised.

Task

For option definitions, click ? in the interface.

Click Menu | Systems Section | System Tree.

Select one or multiple systems.

From the Actions menu, click System Health, then choose the health status to apply to the selected

systems.

The health status is displayed in the TIE System Health column on the System Tree.

To display the TIE System Health column on the System Tree, from the Actions menu, click Choose Columns,

then from the Available Columns list, select TIE System Health.

Using Threat Intelligence Exchange

Monitoring events

McAfee Threat Intelligence Exchange 1.0.0 Product Guide

1 2 ... 17 18 19 20 21 22 23 24 25 26 27 28 29

Sin comentarios

McAfee QUICKCLEAN 1.0 Manual de usuario Pagina 22