Managing Http Response Scanning - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
Alert filter association using the Threat Analyzer
You can select a particular alert and configure an Alert Filter. If necessary, you can create
a new Alert Filter and apply it to the selected alert. You apply an Alert Filter to the resource
for which the alert is raised and the attack for which the alert is raised and the direction of
the attack.

Managing HTTP response scanning

The HTTP Response settings enables you to configure Network Security Platform to
inspect HTTP responses for exploits on a per-monitoring port and direction basis. The
Sensor will be able to scan plain HTML text responses (but not traffic containing zipped,
encrypted or MIME-encoded content)
Note the following:
•
•
•
•
Based on the needs of your organization, you may want to enable HTTP response
inspection for inbound traffic, outbound traffic, or both directions. Consider the examples
below.
Example 1
Assume a scenario where port 1A on your Sensor is connected to the outside network and
1B is connected to your internal network [for example, a Web server]. When a client
machine from outside your network sends a connect request and the Web Server
responds back with malicious traffic, this is treated as outgoing attack. However, since the
origin of the attack is outside your network, enable HTTP response scan on the inbound
traffic.
Steps:
1
HTTP response processing is disabled by default.
You can enable it in each direction on an interface pair.
McAfee recommends that you enable HTTP response processing only if you
anticipate malicious traffic activity on your Web server.
To minimize the potential performance impact on the Sensor, enable HTTP response
processing on the minimum number of ports and in only the required directions to
achieve your protection goals. For performance information, see
IPS Settings > Policies > HTTP Response Scanning
Go to
Sensor / IPS Failover Pair > HTTP Response Scanning
IPS Settings > Sensor_Name > IPS
or
page.
160
The IPS Sensor_Name node
Best Practices Guide
.