How Ips Exceptions Work - McAfee HISCDE-AB-IA - Host Intrusion Prevention Product Manual

Configuring IPS Policies
Define IPS protection
• Click New. A blank Application page appears.
• Select a rule and click Duplicate. After naming and saving the new rule, click Edit.
2 Enter the name (required), status, whether the application rule is included in the protection
list, and the executables to which you want to apply the rule.
NOTE: You can add an existing executable from the Host IPS Catalog by clicking Add From
Catalog. For details on the catalog, see How the Host IPS catalog works under Configuring
Firewall Policies .
3 Click Save.

How IPS exceptions work

Sometimes behavior that would be interpreted as an attack can be a normal part of a user's
work routine. This is called a false positive alert . To prevent false positives, create an exception
for that behavior.
Exceptions enable you to reduce false positive alerts, minimize needless data flowing to the
console, and ensure that the alerts are legitimate security threats.
For example, during the process of testing clients, a client recognizes the Outlook Envelope -
Suspicious Executable Mod. signature. This signature signals that the Outlook e-mail application
is attempting to modify an application outside the envelope of usual resources for Outlook.
Thus, an event triggered by this signature is cause for alarm, because Outlook might be modifying
an application not normally associated with email, for example, Notepad.exe. In this instance,
you might reasonably suspect that a Trojan horse has been planted. But, if the process initiating
the event is normally responsible for sending email, for example, saving a file with Outlook.exe,
you need to create an exception that allows this action.
TIP: If you create a custom signature that prevents modification of files (editing, renaming,
deleting) in a particular folder, but you want to allow a single application to make modifications,
create an exception that would allow the application to make changes to the files. Alternatively,
you could add in the custom signature's subrule the parameter with the application set to
Exclude.
Configuring IPS exceptions
Edit, add, and delete exceptions and move exceptions to another policy from the Exceptions
tab of the IPS Rules policy.
Task
For option definitions, click ? in the interface.
1 Click Menu | Policy | Policy Catalog and select Host Intrusion Prevention: IPS in
the Product list and IPS Rules in the Category list. The list of policies appears.
2 Under Actions, click Edit to make changes on the IPS Rules page, then click the
Exception Rules tab.
3 Perform any of the following operations:
To...
Find an exception rule in the list
46 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
Do this...
Use the filters at the top of the exception list. You can
filter on rule status, modified date, or specific text that
includes rule or notes text. Click Clear to remove filter
settings.