McAfee UTILITIES 4.0 Guide de l'utilisateur télécharger pdf (Page 31)

• Low — Signatures that are behavioral in nature and shield applications. Shielding means

locking down application and system resources so that they cannot be changed. Preventing

these signatures increases the security of the underlying system, but requires additional

fine-tuning.

• Information — Indicates a modification to the system configuration that might create a

benign security risk or an attempt to access sensitive system information. Events at this

level occur during normal system activity and generally are not evidence of an attack.

Types of signatures

The IPS Rules policy can contain three types of signatures:

• Host signatures — Default host intrusion prevention signatures.

• Custom host signatures — Custom host intrusion prevention signatures that you create.

• Network signatures — Default network intrusion prevention signatures.

Default host IP signatures

Host-based intrusion prevention signatures detect and prevent system operations activity attacks,

and includes File, Registry, Service, and HTTP rules. They are developed by the Host Intrusion

Prevention security experts and are delivered with the product and with content updates.

Each signature has a description and a default severity level. With appropriate privilege levels,

an administrator can modify the severity level of a signature.

When triggered, host-based signatures generate an IPS event that appears in the Events tab

of the Host IPS tab under Reporting.

Custom host IP signatures

Custom signatures are host-based signatures that you can create for protection beyond the

default protection. For example, when you create a new folder with important files, you can

create a custom signature to protect it.

NOTE: You cannot create network-based custom signatures.

Network IP signatures

Network-based intrusion prevention signatures detect and prevent known network-based attacks

that arrive on the host system. They appear in the same list of signatures as the host-based

signatures.

Each signature has a description and a default severity level. With appropriate privilege levels,

an administrator can modify the severity level of a signature.

You can create exceptions for network-based signatures; however, you cannot specify any

additional parameter attributes such as operating system user or process name. Advanced

details contain network-specific parameters, for example IP addresses, which you can specify.

Events generated by network-based signatures are displayed along with the host-based events

in the Events tab and exhibit the same behavior as host-based events.

To work with signatures, click the Signatures tab in the IPS Rules policy.

Tasks

Configuring IPS Rules signatures

Creating signatures

Creating signatures using the wizard

Configuring IPS Policies

Working with IPS Rules policies

31McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 26 27 28 29 30 31 32 33 34 35 36 ... 111 112

Commentaires sur ces manuels

Pas de commentaire

McAfee UTILITIES 4.0 Guide de l'utilisateur Page 31

Commentaires sur ces manuels

Produits connexes et manuels pour Logiciel McAfee UTILITIES 4.0