E-Mail Utilization Key Indicators; Virus Detection Events; Checklist - You Think An Outbreak Is Occurring - McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE Manual

®
ePolicy Orchestrator 3.6 Walkthrough Guide

E-mail utilization key indicators

Virus detection events

Checklist — You think an outbreak is occurring
Monitoring tools (for example, tools from Sniffer Technologies) detect a change in
the network utilization levels.
The following are indicators that e-mail utilization may be affected by an outbreak:
Users complain of slowness. Users are often the first to notice when a full-scale
outbreak is taking place. E-mail slows down or does not work at all.
utilization of Microsoft Exchange servers goes up significantly.
CPU
Monitoring tools (for example, tools from Sniffer Technologies) detect a change in
the e-mail utilization levels.
Microsoft Exchange Performance Monitor counters register a change in the e-mail
utilization levels.
McAfee Outbreak Manager notifies you via e-mail that a potential outbreak may be
indicated. McAfee Outbreak Manager analyzes incoming e-mail messages and
identifies behaviors that are indicative of an outbreak.
The McAfee WebShield e500 appliance collects data that can help identify if an
outbreak is occurring.
The following events are indicators that a virus has been detected:
A notification message is received from the ePolicy Orchestrator server, indicating
a virus has been detected.
An ePolicy Orchestrator report identifies that a virus has been detected.
McAfee Outbreak Manager notifies you via e-mail that a potential outbreak may be
indicated.
McAfee Alert Manager notifies you that a virus has been detected.
When an outbreak occurs, you can respond in many ways. Use the You think an
outbreak is occurring checklist to respond to an outbreak.
If you think an outbreak might be occurring, perform the following in your environment:
Visit the AVERT home page to get the latest virus information.
Submit samples of potentially infected files to WebImmune for testing.
Modify the firewall and network security settings to block viral activity. To help you
determine what to block and how the virus behaves, visit the Virus Information
Library on the AVERT web site.
Increase detection settings for all anti-virus products to meet the threat. Visit the
Virus Information Library for an analysis of the threat.
Checklist — You think an outbreak is occurring
75
7
Outbreaks