McAfee QUICKCLEAN 1.0 Uživatelský manuál

Procházejte online nebo si stáhněte Uživatelský manuál pro Softwarové licence / aktualizace McAfee QUICKCLEAN 1.0. Threat Intelligence Exchange 1.0.0 Product Guide Uživatelská příručka

  • Stažení
  • Přidat do mých příruček
  • Tisk

Shrnutí obsahu

Strany 1 - Product Guide

Product GuideMcAfee Threat Intelligence Exchange1.0.0For use with ePolicy Orchestrator 5.1.1 Software

Strany 2 - TRADEMARK ATTRIBUTIONS

• Brokers — Installed on managed systems and communicate messages between ThreatIntelligence Exchange modules. The network of brokers tracks active co

Strany 3 - Contents

How Threat Intelligence Exchange worksThreat Intelligence Exchange is the first product to use the Data Exchange Layer framework to sharefile and thre

Strany 4

6If the file hash is not found in the Threat Intelligence Exchange cache or database, the serverqueries McAfee GTI for the file hash reputation. If fo

Strany 5 - About this guide

2Using Threat Intelligence ExchangeContents Getting started with Threat Intelligence Exchange Blocking or allowing files and certificates Cha

Strany 6 - Find product documentation

Use the Event Manager and McAfee ePO Dashboards to see the files and certificates that are allowedor blocked based on the policies.You can view detail

Strany 7

File-only information• File name, path, size, product, publisher, and prevalence• SHA and MD5 Hash information• Operating system version of the report

Strany 8

Create a Threat Intelligence Exchange module policyPolicy settings determine when a file or certificate is allowed to run, is blocked, or if users are

Strany 9 - Data Exchange Layer

Scenarios• Your site commonly uses a file whose default reputation is unknown or might be classified maliciousbecause it is a custom file. Because you

Strany 10 - Overview

4Select items in the list and use the Actions menu to set reputation override settings. The files orcertificates are then added to the overrides list.

Strany 11

Example import file<?xml version="1.0" encoding="UTF-8"?><TIEReputations> <FileReputation>

Strany 12

COPYRIGHTCopyright © 2014 McAfee, Inc. Do not copy without permission.TRADEMARK ATTRIBUTIONSMcAfee, the McAfee logo, McAfee Active Protection, McAfee

Strany 13

TaskFor option definitions, click ? in the interface.1Click Menu | Systems | TIE Reputations.2Click the File Search tab.3Enter a specific file name, o

Strany 14

Examples• If a specific system regularly prompts users, select the system from the list on the TIE module forVSE Events page. You can then see details

Strany 15 - Certificate-only information

Responding to eventsUse the information on the TIE module for VSE Events page to adjust file and certificate reputations toprevent threats and other e

Strany 16

Managing Data Exchange Layer brokersThe Data Exchange Layer (DXL) includes a client and at least one broker that allows bidirectionalcommunication bet

Strany 17 - Scenarios

To use a Data Exchange Layer broker in a DMZ, firewall rules are necessary. Also, the Data ExchangeLayer topology must be structured in a way that all

Strany 18 - Import reputations

3ReportingYou can access Threat Intelligence Exchange reports from the McAfee ePO Queries & Reports feature.There are reports for the Threat Intel

Strany 19 - Example import file

3ReportingViewing reports26McAfee Threat Intelligence Exchange 1.0.0 Product Guide

Strany 20 - Monitoring events

IndexAabout this guide 5Advanced Threat Defense 14configuring for TIE 16sending files to 15used in determining reputations 11allowing files and certif

Strany 21 - Examples

Product Improvement Program 14promptingsetting up 16Rreputationschanging for a file or certificate 16changing using McAfee ePO API 19how they are adde

Strany 23 - Add brokers to a DMZ

ContentsPreface 5About this guide ... 5Audience ... 5Conventions ...

Strany 24

Contents4McAfee Threat Intelligence Exchange 1.0.0 Product Guide

Strany 25 - Reporting

PrefaceThis guide provides the information you need to work with your McAfee product.Contents About this guide Find product documentationAbout t

Strany 26 - Viewing reports

Find product documentationAfter a product is released, information about the product is entered into the McAfee online KnowledgeCenter.Task1Go to the

Strany 27

1OverviewMcAfee® Threat Intelligence Exchange provides context-aware adaptive security for your enterpriseenvironment.Contents Benefits of Threat I

Strany 28

Threat Intelligence Exchange componentsThreat Intelligence Exchange includes multiple components.• A module for McAfee® VirusScan® Enterprise• A serve

Strany 29

• Create policies that allow or block files and certificates depending on their reputation. Or receive aprompt each time a file or certificate with a

Komentáře k této Příručce

Žádné komentáře