Troubleshooting The Windows Client - McAfee HISCDE-AB-IA - Host Intrusion Prevention Product Manual

Working with Host Intrusion Prevention Clients
Overview of the Windows client
Task
1 In the client console select Task | Set User Interface Language.
2 Select the language for the client console interface and click OK. Options include: Chinese,
English, French, German, Italian, Japanese, Korean, Portuguese, Russian, Spanish. Selecting
"Automatic" displays the interface in the language of the operating system on which the
client is installed.
3 Select Edit | Options.
4 In the Host Intrusion Prevention Options dialog box, select and deselect options as
needed, then click OK.
Table 14: Client console options
Select...
Display pop-up alert
Play sound
Display notification on system tray
Create Sniffer capture if available
Show tray icon

Troubleshooting the Windows client

Host Intrusion Prevention includes a troubleshooting function, which is available from the Help
menu when the interface is unlocked. These options are available:
Table 15: Troubleshooting options
Option
Logging: Firewall
Logging: IPS *
Log security violations *
Show product in Add/Remove Program list
Functionality *
* This option is available only with IPS protection.
NOTE: McAfee provides a utility (ClientControl.exe) to help automate upgrades and other
maintenance tasks when third-party software is used for deploying Host Intrusion Prevention
on client computers. This command-line utility, which can be included in installation and
maintenance scripts to temporarily disable IPS protection and activate logging functions, is
delivered as part of the installation and is located on the client at C:\ Program Files\McAfee\Host
Intrusion Prevention. See Clientcontrol.exe utility under Appendix B -- Troubleshooting for
details.
84 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
To have this happen...
An alert appears when an attack occurs (IPS only).
A sound plays when an attack occurs (IPS only).
The system tray icon indicates an attack status when
an attack occurs (IPS only).
A capture column is added to the Activity Log, indicating
that sniffer intrusion data has been captured. It is saved
to a FirePacketX.cap file at C:\Program
Data\McAfee\Host Intrusion Prevention\McAfee Fire
Saved Events or C:\Documents and Settings\All
Users\Application Data\McAfee\Host Intrusion
Prevention\McAfee Fire Saved Events (IPS only).
Host Intrusion Prevention appears under the McAfee
Agent system tray icon menu.
Definition
Determines which Firewall message type to log.
Determines which IPS message type to log.
Enable the logging of IPS security violations in the IPS log.
Allow Host IPS to appear in the Add/Remove Program list
and be removed from the client.
Disable/re-enable Host IPS class engines as part of
troubleshooting.