McAfee QUICKCLEAN 1.0 Uživatelský manuál stáhnout pdf (Strana 12)

If the file hash is not found in the Threat Intelligence Exchange cache or database, the server

queries McAfee GTI for the file hash reputation. If found, McAfee GTI sends the information back to

the server.

If Advanced Threat Defense is present and the file hash was not found in McAfee GTI, or if the

policy on the endpoint indicates that the file should be sent to Advanced Threat Defense, the server

sends the file for scanning. See the additional steps under If Advanced Threat Defense is present.

The server returns the file hash's enterprise age, prevalence data, and reputation to the module

based on the data that was found. If this is the first time the file is seen in the environment, the

server also sends a first instance flag to the module.

The module evaluates this metadata to determine the file's reputation:

• File and system properties

• Enterprise age and prevalence data

• Reputation

The module takes action based on the policy assigned to the system that is running the file.

The module updates the server with the reputation information and whether the file is allowed or

blocked. It also sends threat events to McAfee ePO via the McAfee Agent.

The server publishes the reputation change event for the file hash.

If Advanced Threat Defense is present

If Advanced Threat Defense is present, the following process occurs.

If the system running the file has access to Advanced Threat Defense and this is the first time the

file is seen in the environment, the Threat Intelligence Exchange server sends the file to Advanced

Threat Defense for scanning.

Advanced Threat Defense scans the file and sends file reputation results to the Threat Intelligence

Exchange server using the Data Exchange Layer. The server also sends the updated reputation

information to all Threat Intelligence Exchange-enabled systems to immediately protect your

environment.

Overview

How a reputation is determined

McAfee Threat Intelligence Exchange 1.0.0 Product Guide

1 2 ... 7 8 9 10 11 12 13 14 15 16 17 ... 28 29

Žádné komentáře

McAfee QUICKCLEAN 1.0 Uživatelský manuál Strana 12