McAfee UTILITIES 4.0 Guide de l'utilisateur télécharger pdf (Page 35)

4 On the Rule Definition tab, select the item to protect against modifications and enter

details.

Figure 8: Signature Creation Wizard— Rule Definitions

5 Click OK.

Working with IPS Application Protection rules

Application protection rules alleviate compatibility and stability issues resulting from process

hooking. These rules permit or block user-level API hooking for defined and generated lists of

processes. Kernel–level file and registry hooking are not affected.

Host Intrusion Prevention provides a static list of processes that are permitted or blocked. This

list is updated with content update releases. In addition, processes that are permitted to hook

are added dynamically to the list when process analysis is enabled. This analysis is performed:

• Each time the client is started and running processes are enumerated.

• Each time a process starts.

• Each time the application protection list is updated by the ePolicy Orchestrator server.

• Each time the list of processes that listen on a network port is updated.

This analysis involves checking first if the process is in the blocked list. If not, the permitted list

is checked. If not in that list, the process is analyzed to see if it listens on a network port or

Configuring IPS Policies

Working with IPS Rules policies

35McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0

1 2 ... 30 31 32 33 34 35 36 37 38 39 40 ... 111 112

Pas de commentaire

McAfee UTILITIES 4.0 Guide de l'utilisateur Page 35