McAfee UTILITIES 4.0 Podręcznik Użytkownika Pobierz pdf (Strona 28)

2 In the IPS Options policy list, click Edit under Actions to change the settings for a custom

policy.

Figure 2: IPS Options

3 In the IPS Options page that appears, make any needed changes, then click Save.

Working with IPS Protection policies

The IPS Protection policy sets the protective reaction for signature severity levels. These settings

instruct clients what to do when an attack or suspicious behavior is detected. Each signature

has one of four severity levels:

• High — Signatures of clearly identifiable security threats or malicious actions. These

signatures are specific to well-identified exploits and are mostly non-behavioral in nature.

Prevent these signatures on every system.

• Medium — Signatures of behavioral activity where applications operate outside their

envelope. Prevent these signatures on critical systems, as well as on web servers and SQL

servers.

• Low — Signatures of behavioral activity where applications and system resources are locked

and cannot be changed. Preventing these signatures increases the security of the underlying

system, but additional fine-tuning is needed.

• Information — Signatures of behavioral activity where applications and system resources

are modified and might indicate a benign security risk or an attempt to access sensitive

system information. Events at this level occur during normal system activity and generally

are not evidence of an attack.

These levels indicate potential danger to a system and enable you to define specific reactions

for different levels of potential harm. You can modify the severity levels and reactions for all

signatures. For example, when suspicious activity is unlikely to cause damage, you can select

ignore as the reaction. When an activity is likely to be dangerous, you can set prevent as the

reaction.

This policy category contains six preconfigured policies and an editable My Default policy. You

can view and duplicate preconfigured policies; you can, create, edit, rename, duplicate, delete,

and export custom policies.

Preconfigured policies include:

Basic Protection (McAfee Default)

• Prevent high severity level signatures and ignore the rest.

Enhanced Protection

Configuring IPS Policies

Working with IPS Protection policies

McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.028

1 2 ... 23 24 25 26 27 28 29 30 31 32 33 ... 111 112

Brak uwag

McAfee UTILITIES 4.0 Podręcznik Użytkownika Strona 28