
You can produce queries for a group of selected client systems, or limit report results by product
or system criteria. You can export reports into a variety of file formats, including HTML and
Microsoft Excel.
Your options include:
• Setting a filter to gather only selected information. Choose which group or tags to include
in the report.
• Setting a data filter using logical operators, to define precise filters on the data returned by
the report.
• Generating graphical reports from the information in the database, and filter the reports as
needed. You can print the reports and export them to other software.
• Running queries of computers, events, and installations.
Predefined and custom queries to analyze your protection
The reporting feature contains predefined queries from Host Intrusion Prevention and allows
you to create custom queries.
You can organize and maintain these queries to suit your needs. For example, if you customize
settings for a report, you can export these settings as a template. You can also create custom
templates and organize templates in logical groupings. For example, you can group queries
that you run daily, weekly, and monthly.
After a report is generated, you view summary information, as determined by the filter, if any,
that you have set. From the summary information you can drill down to one or two levels for
detailed information, all in the same report.
You can control how much report information is visible to different users; for example, global
administrators versus other users. Some users can only view reports on systems in sites where
they have permissions. Report information is also controlled by applying filters.
Custom queries
You can create threeHost IPS queries with the Query Builder wizard: Application Blocking Client
Rules, Firewall Client Rules, and IPS Client Rules. Query parameters include:
IPS Client RulesFirewall Client RulesApplication Blocking Client Rules
• Creation Date• Creation Date• Create Reaction
• Creation Date • Enabled• Direction
• Domain List• Enabled • Full Process Name
• Include All Processes• Effective Reaction• Full Process Name
• Hash • Include All signatures• Enabled
• End Time• Hook Reaction • Include All Users
• Last Modified Date• Full Process Name• Local Version
• Modified Date • Local Version• Hash
• IP Protocol• Process Eval Option • Process Name
• Process Path• Local Service• Process Name
• • Reaction• Local Service typeProcess Path
•• Signature IDLocal Version
• Log Status • User Name
• Match Intrusion
• Modified Date
Managing Your Protection
Management of information
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.014
Comentarios a estos manuales