McAfee MSA09EMB1RAA - Site Advisor Plus 2009 User manual

McAfee SiteAdvisor Enterprise Plus 3.0
Product Guide

COPYRIGHT
Copyright ©2009 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE
EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,
WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in
connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property
of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
License Attributions
Refer to the product Release Notes.
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide2

Contents
Introducing SiteAdvisor Enterprise Plus.................................................5
Benefits of using SiteAdvisor Enterprise Plus....................................................5
Howsafetyratingsarecompiled..............................................................6
Safety icons and balloons protect during searches ...............................................6
Using site safety balloons ............................................................7
SiteAdvisormenuprotectswhilebrowsing......................................................7
Using the SiteAdvisor menu ..........................................................8
Safetyreportsprovidedetails.................................................................9
Viewingsafety reports..............................................................10
Administrators customize policy settings ......................................................11
Setting up a Browsing Security Strategy ..............................................13
Guidelines for creatingastrategy............................................................13
Selecttherightpolicyoptionsandfeatures....................................................14
Information that SiteAdvisor Enterprise Plus sends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Configuring Policies ......................................................................16
How policies work ........................................................................16
Types of policy categories ..................................................................17
Default policy settings .....................................................................17
Creatingand editingpolicies................................................................19
Apply general options......................................................................19
Configuring proxy settings ..........................................................20
Enabling observe mode .............................................................21
Settingthecontrolpaneloption.......................................................21
Blockandwarnsitesbyratingsandthreatfactors...............................................22
Configuring access based on ratings ..................................................22
Use Authorizeand Prohibit listsfor sites.......................................................24
How site patterns work .............................................................25
How multiple-instance policies work...................................................26
Working with Authorize lists .........................................................27
WorkingwithProhibitlists...........................................................32
Customize messages for users ..............................................................35
3McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Creating customized messaging ......................................................35
Disable andreenablethe software ...........................................................38
Disabling and re-enabling from the ePO server..........................................38
Disabling andreenabling from thebrowser.............................................39
Track events for reports....................................................................39
Tracking visits to domains and downloads..............................................40
Tracking domain page views and downloads............................................41
Tracking green site content categories.................................................41
Using Dashboards, Monitors, and Reports ............................................43
Use queries to create reports ...............................................................43
Creating reports ...................................................................44
Running a purge task...............................................................45
Usedashboardsandmonitors...............................................................45
Creating monitors .................................................................46
Reference..................................................................................47
Frequently Asked Questions ................................................................47
Where to find more information .............................................................50
Web Filtering for Endpoint and Web Reporter Appendix.............................51
How web content filtering works.............................................................51
Policy additions with web content filtering.....................................................51
Report and dashboard additions with web content filtering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
How WebReporterworks...................................................................52
Sending Web Reporter logs.................................................................53
Applying the Content Actions policy..........................................................53
Workingwiththe WebReporter..............................................................54
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide4
Contents

Introducing SiteAdvisor Enterprise Plus
McAfee®SiteAdvisor®Enterprise Plus is a browser protection solution that can be deployed
and managed by using McAfee ePolicy Orchestrator®4.0 or 4.5. The client software runs on
managed systems to protect users from threats they encounter while searching and browsing
websites with Internet Explorer or Firefox or downloading files with Internet Explorer. SiteAdvisor
Enterprise Plus is integrated with McAfee advanced protection solutions.
This guide provides information that you need to create a browsing security strategy for your
business and configure SiteAdvisor Enterprise Plus policy options.
Contents
Benefits of using SiteAdvisor Enterprise Plus
How safety ratings are compiled
Safety icons and balloons protect during searches
SiteAdvisor menu protects while browsing
Safety reports provide details
Administrators customize policy settings
Benefits of using SiteAdvisor Enterprise Plus
As SiteAdvisor Enterprise Plus runs on each managed system, it notifies users about threats
they might encounter when searching or browsing websites by displaying the following:
Safety rating for each site
• When searching, safety ratings of green, yellow, red, and gray icons appear next to each
site listed on a search results page.
• When browsing, the SiteAdvisor menu button appears in the browser window in the color
that matches the safety rating for the current site.
Safety report for each site
• The report includes a detailed description of test results and feedback submitted by users
and site owners.
• Users access safety reports to learn more about how the safety rating for a site was
calculated.
Using the ePO Policy Catalog, administrators can create SiteAdvisor Enterprise Plus policies that
determine which sites managed systems can access. They can assign actions to sites based on
their SiteAdvisor rating (for example, block red sites and warn users trying to access yellow
sites). They can create lists of authorized and prohibited sites based on URLs and domains.
Administrators can also customize the messaging that SiteAdvisor Enterprise Plus displays to
managed systems, and prevent users from disabling the client software on managed systems.
5McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

With the addition of the Web Filtering for Endpoint extension, you can expand safety ratings
to include site content and track pages viewed on domain sites. With the addition of Web
Reporter you can create detailed reports on websites.
The SiteAdvisor Enterprise Plus client software supports both Microsoft Internet Explorer and
Mozilla Firefox browsers.
NOTE: The only difference in functionality between the browsers is that Firefox does not allow
users to hide the SiteAdvisor button with the View | Toolbars command or check file
downloads.
How safety ratings are compiled
A McAfee team derives safety ratings by testing a variety of criteria for each site and evaluating
the results to detect common threats.
Automated tests compile safety ratings for a website by:
• Downloading files to check for viruses and potentially unwanted programs bundled with the
download.
• Entering contact information into signup forms to check for resulting spam or a high volume
of non-spam emails sent by the site or its affiliates.
• Checking for excessive popup windows.
• Checking for attempts by the site to exploit browser vulnerabilities.
• Checking for deceptive or fraudulent practices employed by a site.
The team assimilates test results into a safety report that can also include:
• Feedback submitted by site owners, which might include descriptions of safety precautions
used by the site or responses to user feedback about the site.
• Feedback submitted by site users, which might include reports of phishing scams, bad
shopping experiences, and selling services that can be obtained without cost from other
sources.
• Additional analysis by McAfee professionals.
Safety icons and balloons protect during searches
When users type keywords into a popular search engine such as Google, Yahoo!, MSN, Ask, or
AOL.com, color-coded safety icons appear next to sites listed in the search results page:
Tests revealed no significant problems.
(Green, checkmark)
Tests revealed some issues users should know about. For example,
the site tried to change the testers’ browser defaults, displayed
popups, or sent them a significant amount of non-spam email.
(Yellow, exclamation point)
Tests revealed some serious issues that users should consider
carefully before accessing this site. For example, the site sent
testers spam email or bundled adware with a download.
(Red, x)
This site is blocked by a Prohibit List, Rating Actions, or Content
Actions policy option.
(Red, bar)
This site is unrated.
(Gray, question mark)
Introducing SiteAdvisor Enterprise Plus
How safety ratings are compiled
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide6

Placing the cursor over an icon displays a safety balloon that summarizes the safety report for
a site. Click More Info or a report link for a detailed safety report.
Using site safety balloons
Use this task to view additional information available through a site’s safety icon listed in a
search results page.
Task
1Hold the cursor over the site’s safety icon. A safety balloon displays a high-level summary
of the site’s safety report.
2Click a safety report link or the More info link in the safety balloon to view details of the
site's safety report.
SiteAdvisor menu protects while browsing
When users browse to a website, a color-coded menu button appears in the top-left corner of
the window. The color of the button corresponds to the site’s safety rating. Placing the cursor
over this button displays a safety balloon that summarizes the safety report for the site, with
a link to the detailed site report page. The menu button next to the icon displays the SiteAdvisor
menu.
Indicates this...With this color
and symbol...
This button...
The site is safe.Green, checkmark
There might be some issues with the site.Yellow, exclamation
point
There might be some serious issues with the site.Red, x
No rating is available for the site.Gray, question
mark
A communication error occurred with the SiteAdvisor website that
contains rating information.
Gray, disconnected
cables
Client settings that affect the SiteAdvisor menu button
• When SiteAdvisor Enterprise Plus is disabled, the menu button is gray with a question mark.
•When event tracking is disabled for specific sites in the Authorize List or in the Event Tracking
policy, the menu button is gray with a question mark while visiting the sites.
• When a communication error occurs with the SiteAdvisor server, the menu button is gray
with disconnected cables.
• In Internet Explorer, users can display or hide the menu button by using the View |
Toolbars | McAfee SiteAdvisor menu option. This does not affect the functional status
(enabled or disabled) of the SiteAdvisor Enterprise Plus client software.
NOTE: Firefox users cannot hide the menu button while SiteAdvisor Enterprise Plus is enabled.
Introducing SiteAdvisor Enterprise Plus
SiteAdvisor menu protects while browsing
7McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Troubleshooting link
If the gray communication error button appears, a troubleshooting link in the site's safety
balloon opens to a connection status page. This page displays the reason for the communication
error and provides information on possible resolutions. Clicking this link runs these test with
these results:
Explanation if there is an
issue
What this meansTest
Your computer cannot access the
Internet. This might indicate the
Does the browser have internet access?Internet Access
SiteAdvisor policy for proxy
settings are configured
incorrectly. Contact your
administrator.
The SiteAdvisor servers appear
to be down.
Is the SiteAdvisor server down?SiteAdvisor Server Availability
The SiteAdvisor servers are up,
but they are not responding to
requests.
Is the SiteAdvisor server responding to requests?SiteAdvisor Server Response
Format
The Repeat Tests button allows the user to see if the error persists or has been corrected
while the page is open.
Using the SiteAdvisor menu
Use this task to display the options for accessing SiteAdvisor features on managed systems.
Task
1Click the down arrow on the SiteAdvisor menu button to view the SiteAdvisor menu and
do any of the following:
To do this...Select this command...
Display the safety report for the current site (not
available when SiteAdvisor Enterprise Plus is disabled).
NOTE: You can also click Read site report in the site
safety balloon.
View Site Report
Display the current site’s safety balloon (not available
when SiteAdvisor Enterprise Plus is disabled). The
Show Balloon
balloon disappears after a few seconds, or you can click
the close button.
NOTE: The site safety balloon also appears by placing
the cursor over the menu button.
Turn the SiteAdvisor Enterprise Plus client software off
or on (available only when an Enable/Disable policy
option is configured to allow this functionality).
Disable/Enable SiteAdvisor
Access a brief description of browser protection, its
license agreement, and its privacy policy.
About
2If the communication error button appears, show the balloon for the site, and click
Troubleshoot. The connection status page that appears indicates the possible cause of
the communication error.
Introducing SiteAdvisor Enterprise Plus
SiteAdvisor menu protects while browsing
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide8

Safety reports provide details
Users can supplement the color-coded safety information for a site by viewing its detailed safety
report. These reports describe specific threats discovered by testing and include feedback
submitted by site owners and users.
Safety reports for sites are delivered from the McAfee SiteAdvisor and provide the following
information:
ExplanationItem
The overall rating for the website. We determine this rating
by looking at a wide variety of information. First, we
Summary
evaluate a website's email and download practices using
our proprietary data collection and analysis techniques.
Next, we examine the website itself to see if it engages
in annoying practices such as excessive pop-ups or
requests to change your home page. Then we perform an
analysis of its online affiliations to see if the site associates
with other sites flagged as red. Finally, we combine our
own review of suspicious sites with feedback from our
volunteer reviewers and alert you to sites that are deemed
suspicious.
The year the domain name was registered. More recently
registered websites have had less time to prove their safety
and trustworthiness.
Established
The country where a domain is registered. Keep in mind
that it's sometimes more difficult to get good customer
Country
service or resolve disputes with websites registered outside
of your country of residence.
The level of how popular the website is. Don't assume,
however, that popularity always goes hand in hand with
Popularity
safety. For example, some very popular prize sites send
lots of spam, and some very popular file-sharing programs
bundle adware. Likewise, many personal websites, blogs
and small business sites that do not get a lot of traffic can
be safe to browse and use. That's why the analysis behind
SiteAdvisor's overall verdict is so useful.
Overall rating for a website's email practices. We rate sites
based on both how much email we receive after entering
Email Results
an address on the site as well as how spammy the email
we receive looks. If either of these measures is higher
than what we consider acceptable, we'll give the site a
yellow warning. If both measures are high, or one of them
looks particularly egregious, we'll give the site a red
warning.
Each email link opens a detailed email analysis page.
Overall rating about the impact a site's downloadable
software had on our testing computer. Red flags are given
Downloads
to sites that have virus-infected downloads or that add
unrelated software which many people would consider
adware or spyware. The rating also takes note of the
network servers a program contacts during its operation,
as well as any modifications to browser settings or a
computer's registry files.
Each download link opens a detailed download analysis
page.
Introducing SiteAdvisor Enterprise Plus
Safety reports provide details
9McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

ExplanationItem
Indication of how aggressively the site tries to get you to
go to other sites that we've flagged as red. It is a very
Online Affiliations
common practice on the Internet for suspicious sites to
have many close associations with other suspicious sites.
The primary purpose of these "feeder" sites is to get you
to visit the suspicious site. A site can receive a red warning
if, for example, it links too aggressively to other red sites.
In effect, a site can become "red by association" due to
the nature of its relationship to red flagged domains.
Common web practices that users find annoying, such as
excessive pop-ups, requests to change a user's home page,
Annoyances
or requests to add a site to the browser's favorites list.
We also list third-party cookies (sometimes known as
"tracking cookies") in this section. If a website has a lot
of pop-ups, and in particular if it engages in practices such
as popping up more windows when you try to close them,
we will give that website a red flag.
Rare but extremely dangerous security threats caused by
a website "exploiting" a browser's security vulnerability.
Exploits
The exploit can cause the user's computer to receive
programming code that can cause adware infections,
keystroke spying, and other malicious actions that can
leave a computer essentially unusable.
Reviewers and site owners can provide additional
information and commentary to supplement SiteAdvisor's
automated test results.
Reviewer and Site Owner Comments
Summary of the comments of SiteAdvisor's entire reviewer
community. Reviewers can rate sites for downloads, email
Results
practices, shopping experiences and more. This input is
particularly important in helping the SiteAdvisor community
guide each other concerning e-commerce websites.
Anonymous input alone is not enough to change a site's
overall rating, but sufficient votes from registered users
can affect a site's rating.
Allows owners of analyzed websites to address our ratings.
Owners are free to comment, disagree or clarify. These
Website owner comments
comments are posted unedited after we verify the
authenticity of the person leaving the comment. We
manually review all owner comments and if an error was
made, we will try our best to promptly correct it. We don't
allow sites to pay to be rated or to change or improve their
ratings.
What our volunteer reviewers have to say about this
website. These comments are posted unedited.
Reviewer comments
Viewing safety reports
Use this task to view safety reports to obtain more information about a site’s safety rating.
Task
• Do any of the following to view a safety report for a site:
Introducing SiteAdvisor Enterprise Plus
Safety reports provide details
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide10

Do this...From this location...
Website • Click the SiteAdvisor menu button and select Read
Site Details.
• Click the SiteAdvisor button.
Click the safety icon following the web page link.Search results page
Type a URL in the Look up site report box.SiteAdvisor home page (www.siteadvisor.com) or
Analysis page
Administrators customize policy settings
Administrators create SiteAdvisor Enterprise Plus policies in the ePO Policy Catalog and assign
them to managed systems running the SiteAdvisor Enterprise Plus client software. You can
assign the same policy settings to all managed systems, or to groups of managed systems that
perform similar tasks and require the same type of access and protection.
Configure policies in SiteAdvisor Enterprise Plus to achieve the right level of browsing protection
for your users. Note that both the Authorize List and Prohibit List policies are multiple-instance
policies. These policies allow for a profile of settings through the application of multiple policies
under a single policy instance. This can be helpful if you want to apply a default list of sites,
and add entries for a particular group or all groups. Instead of updating the entire list with the
new entries, you can create a second policy instance for the new entries and apply it and the
default list together. The effective policy is then the combination of the two policy instances.
DescriptionPolicy
Authorize List
(A multiple-instance policy)
• Create a list of sites that are approved for users to
access.
• Configure access to site resources, such as file
downloads and phishing pages, on approved sites.
• Specify whether an Authorize list has precedence over
Prohibit lists.
Disable/Enable • Disable and then reenable the SiteAdvisor Enterprise
Plus client software for all ePO managed systems using
this policy.
• Allow the disabling and reenabling of the SiteAdvisor
Enterprise Plus client software from the browser on
managed systems and configure whether or not this
functionality requires a password.
Create messages, which can include your own logo or
image, for users who attempt to access:
Enforcement Messaging
• Blocked sites
• Warned sites
• Authorized sites
• Prohibited sites
• Phishing pages
• File downloads
Event Tracking • Report on domain site visits.
• Report on internal domain site visits.
Introducing SiteAdvisor Enterprise Plus
Administrators customize policy settings
11McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

DescriptionPolicy
• Report on page views on all domain sites. (Available
with with the additional Web Filtering for Endpoint
extension.)
General • Specify proxy server settings required to contact the
Internet by managed systems running the client
software.
• Enable Observe mode to evaluate policy settings
before implementing them.
• Specify whether users can use Add/Remove Programs
to remove SiteAdvisor Enterprise Plus.
Create a list of blocked sites that users cannot access.Prohibit List
(A multiple-instance policy)
Rating Actions • Assign actions (warn, block, or allow) to sites or site
resources (such as file downloads and phishing pages)
based on their ratings.
• Apply threat factors to fine-tune rating actions.
Allow, warn, or block sites based on content categories.Content Actions
(Available with the Web Filtering for Endpoint extension)
See Configuring Policies for more information.
Introducing SiteAdvisor Enterprise Plus
Administrators customize policy settings
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide12

Setting up a Browsing Security Strategy
SiteAdvisor Enterprise Plus includes a default policy with settings recommended by McAfee to
protect managed systems from most web-based threats. This section provides an overview of
features that assist you in customizing policy settings that are specific to your business needs.
The following topics provide details about using these features.
Contents
Guidelines for creating a strategy
Select the right policy options and features
Information that SiteAdvisor Enterprise Plus sends
Guidelines for creating a strategy
Follow these guidelines to design and implement a browsing security strategy that fully protects
your managed systems against web-based threats.
1 Install SiteAdvisor Enterprise Plus, enable Observe mode, and deploy the client
software.
Before deploying the client software, enable Observe mode (Action Enforcement tab on
the General policy page). This prevents SiteAdvisor Enterprise Plus from taking actions
(such as blocking and warning) configured as part of the default policy, but tracks browsing
behavior data that you can retrieve in reports.
See Evaluate policy settings with Observe mode under Configuring Policies .
2 Evaluate browsing traffic and usage patterns (Reports).
Run queries and review the results to learn about network browsing patterns. For example,
what types of sites are users visiting and what tasks are they performing at these sites?
What time of day is browsing traffic heaviest?
See Using Dashboards, Monitors, and Reports .
3 Create policies.
Configure policy options based on the browsing behavior revealed in the query results.
Prohibit, block, or warn about sites or downloads that present threats, and authorize sites
that are important to your users.
See the Configuring Policies chapter for more information.
4 Test and evaluate policy settings (Observe mode).
Enable Observe mode to track the number of users who access sites that would be affected
by the policy settings you have configured. Run queries, then view and evaluate the tracked
data. Are the settings comprehensive enough? Do they have any unintended consequences
you need to resolve? Adjust the policy settings as needed, then disable Observe mode to
activate them.
13McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

See Evaluate policy settings with Observe mode under Configuring Policies .
5 Ensure compliance, productivity, and security with frequent monitoring.
Run queries regularly. View results in reports or in monitors.
• Ensure that the SiteAdvisor Enterprise Plus client software is enabled on all computers
and can function properly (by using the Functional Compliance query).
• Check whether any sites or site resources, such as download files, that are required for
business are blocked.
• Check visits to sites that contain threats.
• Update policy settings to address any problems.
• Run a purge task occasionally to clear out the reports database.
See Using Dashboards, Monitors, and Reports and Configuring Policies .
Select the right policy options and features
When developing a browsing security strategy:
• Assess the security concerns and vulnerabilities that apply to your business.
• Carefully consider any domains and sites that must be accessible to your managed systems
and any that you would like to block.
• Decide which network browsing activities you need to monitor.
• Determine your most effective and efficient forms of monitoring.
Use this list to identify which product features can help meet your goals.
Use this feature...If this is your security or productivity goal...
Rating Actions policyUse SiteAdvisor ratings to control access to sites, download
files, or phishing pages.
Prohibit List policyBlock particular sites or domains.
Authorize List policyEnsure access to particular sites. Control access to
resources on these sites (such as download files). Track
visits to these sites and access of site resources.
Event Tracking policyPrevent data about intranet sites from being reported to
the SiteAdvisor website’s servers.
Enforcement Messaging policyCommunicate to users why a site is blocked or how to
protect against threats on a site.
Disable/Enable policyControl who can disable or enable the SiteAdvisor
Enterprise Plus client software.
Observe mode (part of General policy)Evaluate the effect of policy settings before they are
implemented.
Proxy Server (part of General policy)Enter information on any proxy server needed for Internet
access.
Event Tracking policyObtain information for and track activity on private domain
servers.
Event Tracking policyObtain information for and track visits to non-private
domain servers.
Event Tracking policyObtain information for and track each page accessed from
domain servers.
Setting up a Browsing Security Strategy
Select the right policy options and features
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide14

Use this feature...If this is your security or productivity goal...
Queries and monitorsMonitor the effect of current policy settings.
Functional Compliance queryEnsure that the correct version of the SiteAdvisor
Enterprise Plus client software is installed on all managed
systems and functions properly.
Content Actions policy with Web Filtering for Endpoint
extension
Use site content to control access to sites.
Web Reporter with Web Filtering for Endpoint extensionObtain detailed reports based on site content.
See Configuring Policies for information about using the policy features. See Using Dashboards,
Monitors, and Reports for information about queries and monitors.
Information that SiteAdvisor Enterprise Plus sends
The client software sends the following information to the ePO server for use in queries:
• Type of event initiated by the managed system (site visit or download).
• Unique ID assigned by SiteAdvisor Enterprise Plus to the managed system.
• Time of event.
• Domain for event.
• URL for event.
• SiteAdvisor rating for the event’s site.
• Site threat factor.
• Whether the event’s site or site resource is on an Authorize list, a Prohibit list, or no list.
• Reason for action (allow, warn, or block) taken by SiteAdvisor Enterprise Plus.
• Observe mode status (on or off).
SiteAdvisor Enterprise Plus sends the following information to the SiteAdvisor website’s servers:
• Version of the SiteAdvisor Enterprise Plus client software running on the managed system.
• Version of the operating system running on the managed system.
• Language and country locale selected for the operating system and browser running on the
managed system.
• Host name and part of the URL for each website the managed system requests to access.
• MD5 algorithm for each application the managed system requests to download.
When a managed system visits a website, SiteAdvisor Enterprise Plus tracks the site’s domain
specifier . The domain specifier is the smallest amount of information required for SiteAdvisor
Enterprise Plus to uniquely identify the site being rated for security. The focus of SiteAdvisor
Enterprise Plus is protecting your managed systems; no attempt is made to track personal
Internet usage.
NOTE: SiteAdvisor Enterprise Plus does not send information on your company’s intranet sites
to the SiteAdvisor website’s servers, unless specifically requested. See Tracking visits to domains
and downloads under Configuring Policies for more information.
Setting up a Browsing Security Strategy
Information that SiteAdvisor Enterprise Plus sends
15McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Configuring Policies
For the purposes of this guide, we assume that you have installed ePolicy Orchestrator and
have the necessary privileges to perform the steps described in this guide. For more information
about ePolicy Orchestrator, refer to the product’s documentation.
Contents
How policies work
Types of policy categories
Default policy settings
Creating and editing policies
Apply general options
Block and warn sites by ratings and threat factors
Use Authorize and Prohibit lists for sites
Customize messages for users
Disable and reenable the software
Track events for reports
How policies work
A policy is a collection of software settings that you configure and enforce on managed client
systems. Policies ensure that security software products are configured and function as your
organization requires.
When SiteAdvisor Enterprise Plus is installed, its preconfigured default policy is installed in the
repository. You cannot change this default policy, but you can create a duplicate of this policy
with a different name and configure it to meet your needs.
TIP: Before deploying the SiteAdvisor Enterprise Plus client software to managed systems,
consider carefully how you want the software to behave in your environment. Although you
can reconfigure policies after the software has been deployed, McAfee recommends that you
configure policy settings prior to deployment to prevent unnecessary resource impact.
Policy assignment rules
In general, a policy is applied to a group, and all systems in the group receive the same policy
settings. If, however, you are working in an ePO 4.5 environment, where the ePO server is
version 4.5 and the McAfee Agent on the client system is version 4.5, you can create user-specific
instead of system-specific policy assignments with policy assignment rules. These assignment
rules are enforced on the client system for a particular user when that user logs on, regardless
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide16

of the ePO group in which the system is placed. For more information, see How Policy Assignment
Rules Work in the ePolicy Orchestrator4.5 Product Guide .
NOTE: Policy assignment rules are enforced only if the user logs on as the interactive user. If
a user logs on with a runas command, or logs on to a remote desktop or terminal service where
the user's logon is not set to interactive, the policy assigned to the system and not the one
assigned to the user is enforced.
For recommendations on selecting and implementing SiteAdvisor Enterprise Plus policy settings,
see Setting up a Browsing Security Strategy .
For more information about using policies with ePolicy Orchestrator, see Managing Products
with Policies and Client Tasks in the ePolicy Orchestrator Product Guide .
Types of policy categories
For the SiteAdvisor Enterprise Plus software, configure these policy categories:
•Authorize List — Sites that users are authorized to access, and rules for accessing the
individual resources on the sites. Several instances of this policy can be applied, resulting
in one combined, effective policy.
•Enforcement Messaging — Text displayed to users who attempt to access a site, phishing
page, or file download that has been blocked, warned, or allowed.
•Enable/Disable — Whether the SiteAdvisor Enterprise Plus client software is disabled or
enabled for all managed systems assigned this policy, and whether it can be disabled on
individual systems.
•General — Settings required for managed systems to access the Internet through a proxy
server, to turn on Observe mode to tune enforcement rules, and to allow SiteAdvisor
Enterprise Plus to be removed with Add or Remove Programs.
•Event Tracking — Settings to track domain visits and downloads. If the Web Filtering for
Endpoint extension and Web Reporter are installed, you can also track pages views and
downloads within a domain and send information to Web Reporter for reports.
•Prohibit List — Sites that users are blocked from accessing. Several instances of this policy
can be applied resulting in one combined, effective policy.
•Rating Actions — Rules for user access based on the safety ratings and threat factors
SiteAdvisor assigns to sites, pages on a site, or file downloads.
NOTE: A Content Actions policy appears if the Web Filtering for Endpoint extension is installed.
See the Web Filtering for Endpoint and Web Reporter Appendix for details.
For more information about using policies with ePolicy Orchestrator, see Managing Products
with Policies and Client Tasks in the ePolicy Orchestrator Product Guide .
Default policy settings
During installation, a default SiteAdvisor Enterprise Plus policy is added to the ePO master
repository and listed in the Policy Catalog. The default policy settings are:
Default policy settingsPolicy
No Authorize list is set up.
Authorize List
Configuring Policies
Types of policy categories
17McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

Default policy settingsPolicy
After a list is created, default settings for the advanced
options are:
•Track events: Selected.
•Block phishing pages: Selected.
•File downloads:
•Yellow: Warn
•Red: Block
•Unrated: Allow
•Block sites with exploits: Selected.
•Give this Authorize list precedence: Not
selected.
Enable/Disable •SiteAdvisor policy enforcment — Enable:
Selected. The client software is enabled on all
systems managed with this policy.
•SiteAdvisor menu option — Enable: Not selected.
The client software cannot be disabled from the
managed system.
No custom messages or logos are displayed to users
when they attempt to access allowed, warned, or blocked
sites and site resources.
Enforcement Messaging
General • No proxy settings are defined.
•Observe mode — Enable: Not selected. Options
configured for blocking or warning are enforced.
•Control Panel Option — Enable: Not selected.
to have SiteAdvisor Enterprise Plus appear in the
client system Add or Remove Programs control panel
is not selected.
No Prohibit list is set up.
Prohibit List
Event Tracking •Domains and downloads — Track: Selected.
•Include traffic to internal sites: Set to Never.
•Track content categories for allowed green
sites: Selected. Only available if the Web Filtering
for Endpoint extension is installed.
•Page views and downloads — Track: Not
selected. Only available if the Web Filtering for
Endpoint extension is installed.
Rating Actions •Site navigation rating actions:
•Yellow: Warn
•Red: Block
•Unrated: Allow
•Page-level rating actions: Block phishing pages
selected. Phishing pages detected on allowed sites
are blocked.
Configuring Policies
Default policy settings
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide18

Default policy settingsPolicy
•File download rating actions:
•Yellow: Warn
•Red: Block
•Unrated: Allow
All content categories are allowed.
Content Actions
(Only available when the Web Filtering for Endpoint
extension is installed.)
Creating and editing policies
Use this general task to create a new policy and configure its settings, or to change the settings
in an existing policy. Details for configuring settings in specific policies are provided later in this
section.
Task
For option definitions, click ?in the interface.
1Do one of the following:
• ePolicy Orchestrator 4.0 — Go to Systems | Policy Catalog.
• ePolicy Orchestrator 4.5 — Click Menu | Policy | Policy Catalog.
2From the Product list, select SiteAdvisor Enterprise Plus 3.0.0.
3From the Category list, select the policy.
4Select New to configure settings for a new policy, or select Edit to change settings for an
existing policy.
5Click Save. Run an agent wake-up call to apply the setting immediately, or wait for the
next automatic agent-server communication.
Apply general options
The General policy category lets you apply general policy options that control proxy server
settings, application of Observe mode, and whether the software can be removed from client
systems using the Add or Remove Programs control panel.
Proxy server settings
If proxy servers are set up as intermediaries between managed systems and the Internet, use
policy settings to configure those proxy server settings for SiteAdvisor Enterprise Plus. This
enables SiteAdvisor Enterprise Plus to access the Internet through the proxy servers.
The Proxy Server tab on the General policy page includes settings to:
• Use no proxy server (default).
• Use Internet Explorer proxy server settings.
Configuring Policies
Creating and editing policies
19McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide

• Manually configure proxy server settings.
NOTE: These proxy settings apply only to SiteAdvisor Enterprise Plus. They are not used by
other security software products managed by ePolicy Orchestrator.
Supported proxy servers
• Microsoft Proxy Server 2.0 - Anonymous
• Microsoft Proxy Server 2.0 - Chap
• Microsoft Proxy Server 2.0 - NTLM
• Microsoft ISA Proxy (SP1) - Anonymous
• Microsoft ISA Proxy (SP1) - Chap
• Microsoft ISA Proxy (SP1) - NTLM
• Blue Coat ProxySG
Observe mode action enforcement
Observe mode enables you to evaluate the effect that policy settings for warning or blocking
access have on network browsing activity before you implement them.
Use observe mode to track:
• Visits to red, yellow, or unrated sites.
• Visits to sites you have configured to block or warn.
• Visits to phishing pages you have configured to block.
• Downloads you have configured to block or warn.
Information compiled in observe mode is available by running queries. If you determine that
network browsing patterns are adversely affected by any current settings, adjust them before
disabling observe mode. Policy settings are enforced when observe mode is disabled.
Control panel option
You can allow or prohibit the appearance of SiteAdvisor Enterprise Plus in the Add or Remove
Programs control panel on a client system. If it appears, users can remove SiteAdvisor Enterprise
Plus. You might find this option useful in troubleshooting, but McAfee does not recommend its
application. By default, this option is set to prohibit the appearance of the application in the
control panel.
Configuring proxy settings
Use this task to configure SiteAdvisor Enterprise Plus to access the Internet through proxy
servers.
Task
For option definitions, click ?in the interface.
1Do one of the following:
• ePolicy Orchestrator 4.0 — Go to Systems | Policy Catalog.
• ePolicy Orchestrator 4.5 — Click Menu | Policy | Policy Catalog.
2From the Product list, select SiteAdvisor Enterprise Plus 3.0.0; from the Category
list, select General.
3For the policy you want to edit, click Edit.
Configuring Policies
Apply general options
McAfee SiteAdvisor Enterprise Plus 3.0 Product Guide20