Viewing Blocked Communications - McAfee TSA00M005PAA - Total Protection Service Product Manual

Using Firewall Protection
Managing detections
Before you begin
Users can approve applications only when spyware protection mode or firewall protection
mode is configured as Prompt mode.
Task
For option definitions, click ? in the interface.
1 From the SecurityCenter, do any of the following:
• Click the Computers tab, then click a number in the User-Approved Applications
column to view applications for the associated computer.
• Click the Computers tab, then click the name of a computer. In the Computer Details
page, under Detections, click a number in the User-Approved Applications column to
view applications.
2 To add the application to one or more policies, in the User-Approved Applications list,
under Actions click Allow.
3 In the Add Approved Application page, select each policy where you want to add the
application, then click Save.

Viewing blocked communications

Use this task to view a list of communications that firewall protection prevented from reaching
client computers. For the purposes of this report, each attempt to communicate is called
an event.
Before you begin
To view this report, the Report blocked events option must be enabled on the Firewall
Protection policy tab. When this option is enabled, blocked events are logged for all computers
using the policy.
Task
For option definitions, click ? in the interface.
1 Click the Reports tab, then click Inbound Events Blocked by Firewall.
2 In the report, view detailed information about detections and the computers where
detections occurred by using one of these methods.
When you want to...
Display computers or detections
View details about events
View details about a computer
96
McAfee Total Protection Service Product Guide
Do this...
Click the triangle icon next to a name.
• Under a computer name, show which detections were found.
• Under a detection name, show the computers where it was found.
Click a group name to display computers in that group.
Click a quantity under Events to display the Inbound Event List, which shows
the name of the event, the number of occurrences, and the date on which
it was detected.
Click a computer name to display the Computer Details page, which displays
information about the computer, its service components, and its detections.