McAfee HISCDE-AB-IA - Host Intrusion Prevention User manual

McAfee Host Intrusion Prevention 8.0
Product Guide for use with ePolicy Orchestrator 4.5

COPYRIGHT
Copyright ©2010 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE
EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,
WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in
connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property
of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.52

Contents
Introducing Host Intrusion Prevention..................................................7
Host IPS protection.........................................................................7
Host IPS policies...........................................................................8
Host IPS policy management.................................................................9
HostIPSpolicytrackingandtuning...........................................................10
Managing Your Protection...............................................................12
Information management...................................................................12
Host IPS dashboards...............................................................12
Host IPS queries...................................................................13
Policy management........................................................................16
Where to find policies...............................................................16
Configuring polices.................................................................17
Default protection and tuning........................................................18
Host IPS policy migration............................................................22
System management......................................................................23
Host IPS permission sets............................................................23
Host IPS server tasks...............................................................25
HostIPSeventresponses............................................................26
Host IPS protection updates .........................................................27
Configuring IPS Policies..................................................................29
Overview of IPS policies....................................................................29
Methodsfordelivery of IPS protection.................................................30
Signatures........................................................................31
Behavioralrules....................................................................32
Reactions.........................................................................32
Exceptions........................................................................32
Application protection rules..........................................................33
Events...........................................................................33
Enable IPS protection......................................................................33
Configuring the IPS Options policy....................................................34
Set the reaction for IPS signatures...........................................................35
3McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Configuring the IPS Protection policy..................................................36
Define IPS protection......................................................................36
Configuring the IPS Rules policy......................................................37
Assigningmultiple instances of thepolicy...............................................37
FAQ — Multiple-instance policies......................................................38
How IPS signatures work............................................................39
How IPS application protection rules work..............................................43
HowIPS exceptions work............................................................46
MonitorIPSevents........................................................................47
Managing IPS events...............................................................48
Creating an exception from an event..................................................49
Creating a trusted application from an event............................................50
MonitorIPSclientrules.....................................................................50
Managing IPS client rules............................................................50
Configuring Firewall Policies............................................................52
Overview of Firewall policies................................................................52
How firewall rules work.............................................................53
How firewall rule groups work .......................................................55
How the Host IPS catalog works......................................................58
Firewall stateful packet filtering and inspection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
How learn and adaptive modes affect the firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Firewall client rules.................................................................64
Enable firewall protection...................................................................64
Configuring the Firewall Options policy ................................................65
FAQ—McAfeeTrustedSourceandthefirewall...........................................66
Define firewall protection...................................................................67
ConfiguringtheFirewallRulespolicy...................................................68
Creating and editing firewall rules ....................................................69
Creating and editing firewall rule groups...............................................69
Creatingconnectionisolationgroups...................................................70
Blocking DNS traffic................................................................70
Usingthe HostIPScatalog...........................................................70
Managingfirewallclient rules.........................................................71
FAQ— Useof wildcards inFirewall Rules...............................................72
Configuring General Policies ............................................................73
Overview of General policies................................................................73
Define client functionality...................................................................74
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.54
Contents

ConfiguringaClientUIpolicy.........................................................74
Setting Client UI general options......................................................75
Setting Client UI advanced options and passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Setting Client UI troubleshooting options...............................................76
Define trusted networks....................................................................77
Configuring a Trusted Networks policy.................................................78
Define trusted applications..................................................................78
Configuring a Trusted Applications policy...............................................79
Creating and editing Trusted Application rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Assigningmultiple instances of thepolicy...............................................80
Working with Host Intrusion Prevention Clients .....................................81
OverviewoftheWindowsclient..............................................................81
System tray icon menu..............................................................81
ClientconsoleforWindowsclients.....................................................83
UnlockingtheWindowsclientinterface.................................................83
Setting client UI options.............................................................83
Troubleshooting the Windows client...................................................84
Windows client alerts...............................................................86
AbouttheIPS Policy tab.............................................................88
About the Firewall Policy tab.........................................................89
About the Blocked Hosts tab.........................................................91
EditingtheBlocked Hosts list.........................................................92
About the Application Protection List tab...............................................92
About the Activity Log tab...........................................................93
Overview of the Solaris client ...............................................................94
Policy enforcementwiththeSolarisclient...............................................94
Troubleshooting the Solaris client.....................................................95
Overview of the Linux client ................................................................97
Policy enforcementwith the Linuxclient................................................97
Notes about the Linux client.........................................................97
Troubleshooting the Linux client......................................................98
Appendix A — Writing Custom Signatures and Exceptions.........................101
Rule structure...........................................................................101
Common sections.................................................................102
Optional common sections..........................................................104
Wildcards and variables............................................................104
Windowscustomsignatures................................................................107
5McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
Contents

Windows class Buffer Overflow......................................................107
Windows class Files...............................................................108
Windows class Hook...............................................................111
Windows class Illegal Host IPS API Use...............................................112
Windows class Illegal Use..........................................................113
WindowsclassIsapi (HTTP).........................................................113
Windows class Program............................................................116
Windows class Registry............................................................117
Windows class Services............................................................120
Windows class SQL................................................................122
Classesanddirectivesper Windowsplatform...........................................123
Non-Windowscustomsignatures............................................................127
Solaris/Linux class UNIX_file........................................................127
Solaris/Linux class UNIX_apache (HTTP)..............................................130
Solaris/Linux class UNIX_Misc.......................................................131
Solaris class UNIX_bo..............................................................132
Solaris class UNIX_map............................................................133
Solaris class UNIX_GUID...........................................................133
Classes and directives per UNIX platform..............................................134
Appendix B — Troubleshooting........................................................136
General issues...........................................................................136
Host IPS logs............................................................................141
Clientcontrol.exe utility....................................................................144
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.56
Contents

Introducing Host Intrusion Prevention
McAfee®Host Intrusion Prevention is a host-based intrusion detection and prevention system
that protects system resources and applications from external and internal attacks. It provides
a manageable and scalable intrusion prevention solution for workstations, notebooks, and critical
servers, including web and database servers. Its patented technology blocks zero-day and
known attacks.
Host Intrusion Prevention (sometimes abbreviated in the product as Host IPS or HIP) can protect
information and prevent the compromising of system and network resources and applications
that store and deliver information. It accomplishes this with an end-point firewall feature and
an intrusion prevention system (IPS) feature. The IPS feature has monthly content updates,
which reduces the urgency of patches for new threats. The Host Intrusion Prevention firewall
feature is purchased separately or in combination with the Host Intrusion Prevention IPS feature.
Host Intrusion Prevention is fully integrated with ePolicy Orchestrator and uses its framework
to deliver and enforce policies. This approach provides a single management solution that allows
for mass deployment of up to 100,000 systems in multiple languages across an entire enterprise
for true global coverage.
Contents
Host IPS protection
Host IPS policies
Host IPS policy management
Host IPS policy tracking and tuning
Host IPS protection
After all the required components for Host Intrusion Prevention are installed and communicating,
you are ready to apply protection, monitor events, and update policies and content as needed.
Basic protection
Host Intrusion Prevention ships with a set of default settings that provide basic protection for
your environment. These settings include:
• For IPS protection:
• High severity signatures are prevented and all other signatures are ignored
•McAfee applications are listed as trusted applications for all rules except IPS self-protection
rules
• Predefined applications and processes are protected
• For firewall protection:
7McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Basic network connectivity is allowed•
NOTE: When Host Intrusion Prevention 8.0 is first installed no protection is enabled. You must
enable protection in the IPS Options or Firewall Options policy and apply the policy to the client.
Advanced protection
For advanced protection, switch from the default settings to stronger preset settings, or create
custom settings.
Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing
intrusion prevention protection and access to required information and applications per group
type.
Host IPS policies
A policy is a collection of settings that you configure and enforce through the ePolicy Orchestrator
console. Applying policies ensures that your security needs on managed systems are met. Host
Intrusion Prevention provides three policy features, each with a set of security options. These
are: IPS,Firewall, and General. IPS and firewall features contain a “rules” policy with rules
that define behavior, and an “options” policy that enables or disables the rules.
Ownership of policies is assigned in the Policy Catalog. After a policy is created, it can be
edited or deleted only by the creator of the policy, the person associated as an owner of the
policy, or the global administrator. Deleting a policy can be done only in the Policy Catalog.
IPS policies
The IPS feature contains three policies that protect both Windows and non-Windows computers.
It details exceptions, signatures, application protection rules, events, and client-generated
exceptions.
•IPS Options (All platforms). Turns on or off IPS protection and application of adaptive
mode for tuning.
•IPS Protection (All platforms). Defines the protection reaction to events that signatures
generate.
•IPS Rules (All platforms). Defines signatures, exceptions, and application protection rules.
This policy is a multiple instance policy, which allows for several IPS Rules policies, instead
of a single policy, to be assigned to a system. The effective policy is then the result of the
merged contents of the policies. If there are conflicting settings, the most protective explicit
setting is applied.
Firewall policies
The Firewall feature contains three policies that protect Windows computers only. It filters
network traffic, allowing legitimate traffic through the firewall and blocking the rest.
•Firewall Options (Windows only). Turns on or off firewall protection and application of
adaptive or learn mode for tuning.
•Firewall Rules (Windows only). Defines firewall rules.
•Firewall DNS Blocking (Windows only). Defines the domain name servers that are to be
blocked.
Introducing Host Intrusion Prevention
Host IPS policies
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.58

General policies
The General feature contains three policies that can apply to both the IPS and Firewall features.
•Client UI (Windows only). Defines access to the Host Intrusion Prevention user interface
on Windows client systems, including troubleshooting options. Also provides
password-protection on all non-Windows client systems.
•Trusted Networks (Windows only). Lists IP addresses and networks that are safe for
communication. Used with the IPS and Firewall features.
•Trusted Applications (All platforms). Lists applications that are trusted to perform most
operations. Used with the IPS feature. This policy is also a multiple instance policy, which
allows for several Trusted Applications policies, instead of a single policy, to be assigned to
a system. The effective policy is the result of the merged contents of the policies. If there
are conflicting settings, the most protective setting is applied.
Host IPS policy management
The ePolicy Orchestrator console allows you to configure Host Intrusion Prevention policies
from a central location.
How policies are enforced
When you change Host Intrusion Prevention policies in the ePolicy Orchestrator console, the
changes take effect on the managed systems at the next agent-server communication. This
interval is set to occur once every 60 minutes by default. To enforce policies immediately, you
can send an agent wake-up call from the ePolicy Orchestrator console.
Policies and their categories
Policy information for Host Intrusion Prevention is grouped by feature and category . Each policy
category refers to a specific subset of policies.
A policy is a configured group of settings for a specific purpose. You can create, modify, or
delete as many policies as needed.
Each policy has a preconfigured McAfee Default policy, which cannot be edited or deleted.
Except for IPS Rules and Trusted Applications, all policies also have an editable My Default
policy based on the default policy. Some policy categories include several read-only preconfigured
policies. If these preconfigured policies meet your needs, you can apply any one of them. These
read-only policies, like all policies, can be duplicated and the duplicate customized, if needed.
IPS Rules and Trusted Applications policies are multiple-instance policies because you can assign
multiple policy instances under a single policy. The policy instances are automatically combined
into one effective policy.
TIP: The McAfee Default policies for IPS Rules and Trusted Applications are automatically
updated as part of the content update process. McAfee recommends always assigning these
policies to all clients and creating additional policy instances to customize the behavior of these
two policies.
How policies are applied
Policies are applied to any System Tree group or system by inheritance or assignment.
Inheritance determines whether the policy settings for any system are taken from its parent.
By default, inheritance is enabled throughout the System Tree. You can break inheritance by
Introducing Host Intrusion Prevention
Host IPS policy management
9McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

direct policy assignment . Host Intrusion Prevention, as managed by ePolicy Orchestrator, enables
you to create policies and assign them without regard to inheritance. When you break this
inheritance by assigning a new policy, all groups and systems below inherit the new policy.
Policy ownership
Each policy is required to have an assigned owner. Ownership ensures that no one can modify
the policy other than the global administrator, the creator of the policy, or the person associated
as the policy owner. Any administrator can use any policy that exists in the catalog, but only
the creator, owner, or global administrator can modify it.
TIP: Rather than use a policy owned by a different administrator, we recommend that you
duplicate the policy, then assign the duplicate. Otherwise, if you assign a policy that you do
not own to System Tree groups that you administer, and the owner of the policy modifies it,
all systems to which this policy is assigned receive these modifications.
Host IPS policy tracking and tuning
The deployment and management of Host Intrusion Prevention clients are handled from ePolicy
Orchestrator. In the ePO System Tree you can group systems hierarchically by attributes. For
example, you might group a first level by geographic location and a second level by operating
system platform or IP address. McAfee recommends grouping systems by Host Intrusion
Preventionn configuration criteria, including system type (server or desktop), use of major
applications (web, database, or mail server), and strategic locations (DMZ or intranet). You can
place systems that fit a common usage profile into a common group on the System Tree. In
fact, you might name a group after its usage profile, for example, Web Servers .
With computers grouped in the System Tree according to type, function, or geographic location,
you can easily divide administrative functions along the same lines. With Host Intrusion
Prevention you can divide administrative duties based on product features, such as IPS or
firewall.
Deploying Host Intrusion Prevention to thousands of computers is easily managed because
most computers fit into a few usage profiles. Managing a large deployment is reduced to
maintaining a few policy rules. As a deployment grows, newly added systems should fit one or
more existing profiles, and be placed under the correct group on the System Tree.
Preset protection
Host Intrusion Prevention offers two types of protection:
• Basic protection is available through the McAfee Default policy settings. This protection
requires little or no tuning and generates few events. For many environments this basic
protection might be sufficient.
• Advanced protection is also available from some preconfigured IPS and firewall policies or
by creating custom policies. Servers, for example, need stronger protection than that offered
in basic protection.
Both scenarios require some tuning of protection settings for actual working environments is
required.
Adaptive mode
To help tune protection settings, Host Intrusion Prevention clients can create client-side rules
to server-mandated policies that block legitimate activity. The automatic creation of client rules
Introducing Host Intrusion Prevention
Host IPS policy tracking and tuning
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.510

is permitted when clients are placed in adaptive mode. In adaptive mode, client rules are created
without interaction from the user. After client rules are created, you need to carefully analyze
them and decide which to convert to server-mandated policies.
Often in a large organization, avoiding disruption to business takes priority over security concerns.
For example, new applications might need to be installed periodically on some computers, and
you might not have the time or resources to immediately tune them. Host Intrusion Prevention
enables you to place specific computers in adaptive mode for IPS protection. Those computers
can profile a newly installed application, and forward the resulting client rules to the ePolicy
Orchestrator server. The administrator can promote these client rules to an existing or new
policy, then apply the policy to other computers to handle the new software.
Systems in adaptive mode have virtually no protection, so the adaptive mode should be used
only for tuning an environment and eventually turned off to tighten the system’s protection.
Tuning
As part of Host Intrusion Prevention deployment, you need to identify a small number of distinct
usage profiles and create policies for them. The best way to achieve this is to set up a test
deployment, then begin reducing the number of false positives and generated events. This
process is called tuning .
Stronger IPS rules target a wider range of violations and generate more events than in a basic
environment. If you apply advanced protection, McAfee recommends using the IPS Protection
policy to stagger the impact. This entails mapping each of the severity levels (High, Medium,
Low, and Information) to a reaction (Prevent, Log, Ignore). By initially setting all severity
reactions except High to Ignore, only the High severity signatures are applied. The other levels
can be raised incrementally as tuning progresses.
You can reduce the number of false positives by creating exception rules , trusted applications ,
and firewall rules .
• Exception rules are mechanisms for overriding an IPS signature in specific circumstances.
• Trusted applications are application processes that ignore all IPS or Firewall rules.
• Firewall rules determine whether traffic is permissible, and block packet reception or allow
or block packet transmission.
Dashboards and queries
Dashboards enable you to track your environment by displaying several queries at once. These
queries can be constantly refreshed or run at a specified frequency.
Queries enable you to obtain data about a particular item and filter the data for specific subsets
of that data; for example, high-level events reported by particular clients for a specified time
period. Reports can be scheduled and sent as an email message.
Introducing Host Intrusion Prevention
Host IPS policy tracking and tuning
11McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Managing Your Protection
Management of a Host Intrusion Prevention deployment includes monitoring, analyzing, and
reacting to activities; changing and updating policies; and performing system tasks.
Contents
Information management
Policy management
System management
Information management
After you have installed Host Intrusion Prevention, you can track and report on security issues
that arise in your environment. Use the dashboards for a daily view of the security situation or
to run queries for detailed information on particular issues.
Host IPS dashboards
Dashboards are a collection of monitors that are an essential tool for managing your environment.
Monitors can be anything from a chart-based query to a small web-application, like the MyAvert
Threat Service. You can create and edit multiple dashboards if you have the permissions. Use
any chart-based query as a dashboard that refreshes at a specified frequency, so you can put
your most useful queries on a live dashboard.
Host Intrusion Prevention provides two default dashboards with these monitors:
Table 1: Host IPS dashboards and monitors
MonitorsDashboard
Host IPS • Firewall Status
• Host IPS Status
• Service Status
• Count of IPS Client Rules
• Content Versions
• Top 10 NIPS Events by Source IP
Host IPS Triggered Signatures • Desktop High Triggered Signatures
• Desktop Medium Triggered Signatures
• Desktop Low Triggered Signatures
• Server High Triggered Signatures
• Server Medium Triggered Signatures
• Server Low Triggered Signatures
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.512

For more information about creating and using dashboards, see the ePolicy Orchestrator
documentation.
Host IPS queries
Host Intrusion Prevention includes query functionality through ePolicy Orchestrator. You can
create useful queries from events and properties stored in the ePO database or use predefined
queries.
You can produce queries for a group of selected client systems, or limit report results by product
or system criteria. You can export reports into a variety of file formats, including HTML and
Microsoft Excel.
Query options:
• Setting a filter to gather only selected information. Choose which group or tags to include
in the report.
• Setting a data filter using logical operators, to define precise filters on the data returned by
the report.
• Generating graphical reports from the information in the database, filtering the reports as
needed, printing the reports, and exporting them to other software.
• Running queries of computers, events, and installations.
Predefined and custom queries to analyze your protection
The reporting feature contains predefined queries from Host Intrusion Prevention and allows
you to create custom queries.
Organize and maintain custom queries to suit your needs. For example, if you customize settings
for a report, export these settings as a template. After creating custom templates, organize
them in logical groupings so that you can run them as needed on a daily, weekly, or monthly
basis.
After a report is generated, you view summary information, as determined by the filter, if any,
that you have set. From the summary information you drill down to one or two levels for detailed
information, all in the same report.
You control how much report information is visible to different users; for example, global
administrators versus other users. Some users view reports only on systems in sites where they
have permissions. Report information is also controlled by applying filters.
Custom queries
You can create four specific Host IPS queries with the Query Builder under Others: Host IPS
8.0 Firewall Client Rules, Host IPS 8.0 Firewall Client Rule Executables, Host IPS 8.0 IPS Client
Rules, and Host IPS 8.0 IPS Exceptions.
Parameters for these queries include:
Table 2: Host IPS queries and parameters
ParametersQuery
Host IPS 8.0 Catalog Firewall Rules and Firewall
Client Rules
NOTE: This query returns IPS Catalog firewall
rules, IPS Catalog firewall groups, and firewall
• Action
• Direction
• Enabled
• Last Modified
client rules. Possible action values are allow , block ,
and jump , with jump the action for groups, which • Last Modifying User
Managing Your Protection
Information management
13McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

ParametersQuery
have no allow/block action. IPS Catalog rules and
groups have the leafNodeId filter value set to 0 ,
• Leaf Node ID
• Local Services
so to view firewall client rules only, set the
leafNodeId filter value to > 0 .• Log Status
• IP Protocol
• Match Intrusion
• Media Type
• Name
• Note
• Remote Services
• Rule ID
• Schedule End
• Schedule Start
• Switch When Expired
• Transport Protocol
Host IPS 8.0 Firewall Client Rule Executables • Fingerprint
• Name
• Note
• Path
• Rule ID
• Signer Name
Host IPS 8.0 IPS Client Rules • Creation Date
• Description
• Executable Name
• Executable Path
• Fingerprint
• Full Executable Name
• Include All Executables
• Include All Signatures
• Include All Users
• Last Modified Date
• Local Version
• Reaction
• Signature ID
• Signer Name
• Status
• User Name
Host IPS 8.0 IPS Exceptions • IPS Exception Rule
• IPS Rules Policy
Common Host IPS properties
The Host IPS custom queries and some of the other custom queries allow you to include these
Host IPS properties:
• IPS Adaptive Mode Status• Agent type
Managing Your Protection
Information management
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.514

• Blocked Attackers • Language
• Local Exception Rule Count• Client Version
• Content Version • Network IPS Status
• Pending Reboot• Firewall Adaptive Mode Status
• Firewall Fault (Errors) • Plug-in Version
• Product Status• Firewall Inbound Learn Mode Status
• Firewall Outbound Learn Mode Status • Service Running
• Hotfix/Patch Version• Firewall Rule Count
• Firewall Status • Product Version
• Service Pack• Host IPS Fault (Errors)
• Host IPS Status • Host IPS Event Info (Hidden, Read)
•• Signature NameInstall Directory
Pre-defined queries
In addition to custom queries, you can use several pre-defined queries as is, or edit them to
obtain just the information you need. Select from these Host IPS predefined queries:
SummaryHIP Query
Displays firewall client rules listed by process.Client Rules By Process
Displays firewall client rules listed by process and port range.Client Rules By Process/Port
Range
Displays firewall client rules listed by process and user.Client Rules By Process/User
Displays firewall client rules listed by protocol and system name.Client Rules By
Protocol/System Name
Displays firewall client rules listed by protocol and port range.Client Rules By Protocol/Port
Range
Displays firewall client rules listed by protocol and process.Client Rules by
Protocol/Process
Displays top three client versions with a single category for all other versions.Client Versions
Displays managed systems where Host IPS is deployed and the installer needs to
restart the system.
Clients Pending Restart
Displays top three content versions with a single category for all other versions.Content Versions
Displays the number of Firewall client rules created over time.Count of FW Client Rules
Displays the number of IPS client rules created over time.Count of IPS Client Rules
Displays the top 10 most triggered IPS signatures of High Severity (Critical).Desktop High Triggered
Signatures
Displays the top 10 most triggered IPS signatures of Medium Severity (Warning).Desktop Medium Triggered
Signatures
Displays the top 10 most triggered IPS signatures of Low Severity (Notice).Desktop Low Triggered
Signatures
Displays events generated by systems within Host IPS trusted networks.Events From Host IPS Trusted
Networks
Managing Your Protection
Information management
15McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

SummaryHIP Query
Displays managed systems where the Firewall feature is enabled by policy but didn't
start successfully.
Firewall Errors
Displays where Firewall protection is enabled or disabled on managed systems.Firewall Status
Displays managed systems where the IPS feature is enabled by policy but didn't start
successfully.
Host IPS Errors
Displays where IPS protection is enabled or disabled on managed systems.Host IPS Status
Displays IPS Rule policies that use IPS exceptions.IPS Exceptions Report
Displays the top 10 most triggered IPS signatures of High Severity (Critical).Server High Triggered
Signatures
Displays the top 10 most triggered IPS signatures of Medium Severity (Warning).Server Medium Triggered
Signatures
Displays the top 10 most triggered IPS signatures of Low Severity (Notice).Server Low Triggered
Signatures
Displays where Host IPS is installed and whether it is running or not on managed
systems.
Service Status
Displays the top 10 systems with the most IPS events.Top 10 IPS Events by Target
Displays the top 10 network intrusion events by source IP addresses for the past three
months.
Top 10 NIPS By Source IP
Displays the top 10 triggered IPS signatures.Top 10 Triggered Signatures
Policy management
Management of policies involves configuring and applying policies and the tuning of protection
for system resources and applications. Part of this process requires an analysis of events and
client rules.
Where to find policies
ePolicy Orchestrator provides two locations to view and manage Host Intrusion Prevention
policies: the Assigned Policies tab (Systems | System Tree | Assigned Policies tab for a
selected group in the System Tree) and the Policy Catalog tab (Systems | Policy Catalog).
For a selected group or system, use the Assigned Policies tab to:
• View the available policies of a particular feature of the product
• View details of the policy
• View inheritance information
• Edit policy assignment
• Edit custom policies
Use the Policy Catalog to:
• Create policies
• View and edit policy information
• View where a policy is assigned
Managing Your Protection
Policy management
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.516

• View the settings and owner of a policy
• View assignments where policy enforcement is disabled
Do this...To...
Click New Policy, name it, and edit the settings.Create a policy
Click Edit (only available for My Default or custom policies).Edit a policy
Click View (only available for McAfee Default or preconfigured policies).View a policy
Click Rename and change the name of the policy (not available for default
or preconfigured policies).
Rename a policy
Click Duplicate, change the name of the policy, and edit the settings.Duplicate a policy
Click Delete (not available for default or preconfigured policies).
NOTE: When you delete a policy, all groups to which it is currently applied
inherit the policy of this category from their parent. Before deleting a policy,
Delete a policy
look at all of the systems where it is assigned, and assign a different policy
if you don’t want the policy to inherit from the parent. If you delete a policy
that is applied at the top level, the default policy of this category is applied.
Click the owner of the policy and select another owner from a list (not available
for default or preconfigured policies).
Assign a policy owner
Click Export, then name and save the policy (an XML file) to the desired
location.
Export a policy
Click Export all policies, then name and save the policy XML file to the
desired location.
Export all policies
Click Import at the top of the Policy Catalog page, select the policy XML file,
then click OK.
Import policies
For details on any of these features, see the ePolicy Orchestrator documentation.
Configuring polices
After you install the Host Intrusion Prevention software, McAfee recommends that you configure
policies to provide the greatest amount of security without conflicting with day-to-day activities.
The default policies in Host Intrusion Prevention fit the broadest set of customer environments
and might meet your needs. To tune policies to fit your particular setting, we recommend the
following:
• Carefully define your Host Intrusion Prevention security configuration. Evaluate who is
responsible for configuring particular parts of the system and grant them appropriate
permissions.
• Change the default IPS Protection or Firewall Rules policies, which provide increasing levels
of preset protection.
• Modify severity levels of specific signatures. For example, when a signature is triggered by
the day-to-day work of users, adjust the severity to a lower level.
• Configure dashboards for a quick overview of compliance and issues.
• Configure automatic responses to alert specific individuals when particular events occur. For
example, a notification can be sent when an activity that triggers a High severity event
occurs on a particular server.
Managing Your Protection
Policy management
17McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

Creating a new policy
To create a new policy, you copy of an existing one and name the new copy. You can do this
either in the Policy Catalog or from a Policy page.
Task
For option definitions, click ?in the interface.
• Do one of the following from the Policy Catalog:
• Click the New Policy button. Select the policy you want to make a copy of, type the
name of the new policy, and click OK.
• Click the Duplicate link for a policy. Type the name of the new policy, and click OK.
• Click the View or Edit link for a policy, then on the Policy page, click the Duplicate
button. Type the name of the new policy, and click OK. The duplicated policy appears.
Edit the policy and click Save.
Changing policy assignment
Use this task to change the Host Intrusion Prevention policy assignment for a group or a single
system in the ePolicy Orchestrator System Tree.
Task
For option definitions, click ?in the interface.
• Do one of the following:
• For a group, go to Systems | System Tree, select a group, and then on the Assigned
Policies tab click Edit Assignment.
• For a system go to Systems | System Tree, select a group that contains the system,
and then on the System tab, select the system and select Actions | Agents | Modify
Policies on a Single System.
Default protection and tuning
Host Intrusion Prevention works with default policies for basic protection. It allows greater
protection through custom settings obtained through manual or automatic tuning.
Default protection
Host Intrusion Prevention ships with a set of default policies that provide basic protection for
your environment. Both IPS and firewall protection are off by default and must enabled to allow
default rules policies to be enforced.
For advanced protection, switch from the default IPS policies to stronger preset policies, or
create custom policies.
Start with a sample deployment to monitor and tune the new settings. Tuning involves balancing
intrusion prevention protection and access to required information and applications per group
type.
Manual tuning
Manual tuning requires direct monitoring for a set period of time of events and client rules that
are created.
Managing Your Protection
Policy management
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.518

• For IPS protection, monitor events for false positives and create exceptions or trusted
applications to prevent these events from reoccurring.
•For firewall protection, monitor network traffic and add trusted networks to allow appropriate
network traffic.
• Monitor the effects of the new exceptions, trusted applications, and trusted networks.
• If these rules succeed in preventing false positives, keeping network traffic to a minimum,
and allowing legitimate activity, make them part of a new or existing policy.
• Apply the new policy to a set of computers and monitor the results.
• Repeat this process with each production group type.
Automatic tuning
Automatic tuning removes the need to constantly monitor all events and activities for all users.
• Apply adaptive mode for IPS and Firewall policies.
• In adaptive mode, IPS events are not triggered and activity is not blocked, except for
malicious exploits. Client rules are created automatically to allow legitimate activity.
• Review the lists of client rules.
• Promote appropriate client rules to administrative policy rules.
• After a few weeks, turn off the adaptive mode.
• Monitor the test group for a few days to be sure the policy settings are appropriate and offer
the desired protection.
• Repeat this process with each production group type.
Clients and planning your deployment
The Host Intrusion Prevention client is the essential component providing protection. When
deploying clients, we recommend a phased approach:
•Determine your initial client rollout plan. Although you can deploy Host Intrusion
Prevention clients to every host (servers, desktops, and laptops) in your company, McAfee
recommends that you start by installing clients on a limited number of representative systems
and tuning their configuration. After you have fine-tuned the deployment, you can then
deploy more clients and leverage the policies, exceptions, and client rules created in the
initial rollout.
•Establish a naming convention for your clients. Clients are identified by name in the
System Tree, in certain reports, and in event data generated by activity on the client. Clients
can take the names of the hosts where they are installed, or you can assign a specific client
name during installation. McAfee recommends establishing a naming convention for clients
that is easy to interpret by anyone working with the Host Intrusion Prevention deployment.
•Install the clients. Clients can be installed with a default set of IPS and firewall policies.
New policies with updated rules can later be pushed from the server.
•Group the clients logically. Clients can be grouped according to any criteria that fits in
the System Tree hierarchy. For example, you might group clients according to their geographic
location, corporate function, or the characteristics of the system.
Client data and what it tells you
After you install and group your clients, the deployment is complete. You should begin to see
events triggered by activity on the clients. If you have placed clients in adaptive mode, you
Managing Your Protection
Policy management
19McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

should see the client rules that indicate which client exception rules are being created. By
analyzing this data, you begin to tune the deployment.
To analyze event data, view the Events tab of the Host IPS tab under Reporting. You can drill
down to the details of an event, such as which process triggered the event, when the event
was generated, and which client generated the event. Analyze the event and take the appropriate
action to tune the Host Intrusion Prevention deployment to provide better responses to attacks.
The Events tab displays all Host IPS events, including NIPS, Firewall intrusions, and TrustedSource
block events.
To analyze client rules, view the IPS Client Rules and Firewall Client Rules tabs. You can see
which rules are being created, aggregate them to find the most prevalent common rules, and
move the rules directly to a policy for application to other clients.
In addition, the ePolicy Orchestrator Reporting module provides detailed reports based on
events, client rules, and the Host Intrusion Prevention configuration. Use these queries to
communicate environment activity to other members of your team and management.
Adaptive mode
A major element in the tuning process includes placing Host Intrusion Prevention clients in
adaptive mode for IPS and Firewall. This mode allow computers to create client exception rules
to administrative policies. Adaptive mode does this automatically without user interaction.
This mode analyzes events first for the most malicious attacks, such as buffer overflow. If the
activity is considered regular and necessary for business, client exception rules are created. By
setting representative clients in adaptive mode, you can create a tuning configuration for them.
Host Intrusion Prevention then allows you to take any, all, or none of the client rules and convert
them to server-mandated policies. When tuning is complete, turn off adaptive mode to tighten
the system’s intrusion prevention protection.
• Run clients in adaptive mode for at least a week. This allows the clients time to encounter
all the activity they would normally encounter. Try to do this during times of scheduled
activity, such as backups or script processing.
• As each activity is encountered, IPS events are generated and exceptions are created.
Exceptions are activities that are distinguished as legitimate behavior. For example, a policy
might deem certain script processing as illegal behavior, but certain systems in your
engineering groups need to perform such tasks. Allow exceptions to be created for those
systems, so they can function normally while the policy continues to prevent this activity on
other systems. Then make these exceptions part of a server-mandated policy to cover only
the engineering group.
• You might require software applications for normal business in some areas of the company,
but not in others. For example, you might allow Instant Messaging in your Technical Support
organization, but prevent its use in your Finance department. You can establish the application
as trusted on the systems in Technical Support to allow users full access to it.
• The Firewall feature acts as a filter between a computer and the network or the Internet.
The firewall scans all incoming and outgoing traffic at the packet level. As it reviews each
arriving or departing packet, the firewall checks its list of firewall rules, which is a set of
criteria with associated actions. If a packet matches all the criteria in a rule, the firewall
performs the action specified by the rule — which allows the packet through the firewall, or
blocks it.
Managing Your Protection
Policy management
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.520