McAfee UTILITIES 4.0 Guía de usuario descargar pdf (Pagina 41)

applications that use TCP/IP Port 25 typically reserved for email applications, and this action

would be detected by the TCP/IP Port 25 Activity (SMTP) signature. On the other hand, normal

email traffic might also match this signature. When you see this signature, investigate the

process that initiated the event. If the process is one that is not normally associated with email,

like Notepad.exe, you might reasonably suspect that a Trojan was planted. If the process

initiating the event is normally responsible for sending email (Eudora, Netscape, Outlook), create

an exception to that event.

You may also find, for example, that a number of clients are triggering the signature startup

programs, which indicates the modification or creation of a value under the registry keys:

HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run

HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/RunOnce

As the values stored under these keys indicate programs that are started when the computer

starts up, recognition of this signature may indicate that someone is attempting to tamper with

the system. Or it might indicate something as benign as one of your employees installing

RealAudio on their computer. The installation of RealAudio adds the value RealTray to the

Run registry key.

To eliminate the triggering of events every time someone installs authorized software, you

create exceptions to these events. The client will no longer generate events to this authorized

installation.

Filtering and aggregating events

Applying filters generates a list of events that satisfies all of the variables defined in the filter

criteria. The result is a list of events that includes all of the criteria.Aggregating events generates

a list of events grouped by the value associated with each of the variables selected in the Select

columns to aggregate dialog box. The result is a list of events displayed in groups and sorted

by the value associated with the selected variables.

Tasks

Managing IPS events

Use this task to analyze IPS events and, in reaction to them, create exceptions or trusted

applications.

NOTE: IPS events also appear on the Event Log tab under Reporting combined with all other

events for all systems. Access to the events tabs under Reporting requires additional permission

sets, including view permissions for Event Log, Systems, and System Tree access.

Task

For option definitions, click ? on the page displaying the options.

1 Go to Reporting | Host IPS | IPS Events.

Configuring IPS Policies

Working with IPS Rules policies

41McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 36 37 38 39 40 41 42 43 44 45 46 ... 111 112

Sin comentarios

McAfee UTILITIES 4.0 Guía de usuario Pagina 41