McAfee MVISION Endpoint 1811 Product Guide

Transcription

1 McAfee MVISION Endpoint 1811 Product Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee MVISION Endpoint 1811 Product Guide

3 Contents 1 Product overview 5 Overview Key features How it works Getting started with MVISION Endpoint 11 About the MVISION Endpoint user interface MVISION Endpoint policies General policies Exclusions policy Firewall Rules Using Protection Workspace to identify and remediate threats 19 Using the Protection Workspace with MVISION Endpoint Getting started with the Protection Workspace Threat Event workflow example Apply Protection Workspace tags to systems Managing quarantined content 23 Using the quarantined content area Viewing and handling quarantined content A Managed settings 25 Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint MVISION Endpoint settings McAfee MVISION Endpoint 1811 Product Guide 3

4 Contents 4 McAfee MVISION Endpoint 1811 Product Guide

5 1 Product 1 overview Contents Overview Key features How it works Overview McAfee MVISION Endpoint enhances Microsoft Windows Defender Antivirus and with machine-learning security technologies and allows you to monitor potential threats on endpoints managed by Microsoft Windows 10 (Fall Creators Update and later). It uses a range of zero-day detection capabilities from McAfee, both online and offline, to provide enhanced protection for your users. MVISION Endpoint also provides centralized management of Microsoft Windows Defender Firewall rules. MVISION Endpoint offers common management from McAfee epolicy Orchestrator (McAfee epo ), allowing you to use one unified protection policy for McAfee technologies and Windows Defender Antivirus. The software shows the threat and security compliance status of your endpoints for McAfee and Microsoft technologies, with filtering capability across devices and threats. MVISION Endpoint also provides centralized management of Microsoft Windows Defender Firewall from McAfee epo. The Protection Workspace dashboard enables you to monitor unresolved detections, escalated devices, and resolved threats on managed endpoints. Summaries of firewall rule hits and endpoint compliance are also displayed. Key features MVISION Endpoint provides improved protection for your Microsoft Windows 10 endpoints. Enhanced detection for Windows Defender Antivirus Windows Defender Antivirus provides basic virus and malware detection. If Windows Defender Antivirus allows a file to execute, MVISION Endpoint then provides the enhanced analysis of the file. MVISION Endpoint uses local and cloud technologies to detect and provide protection against the threats that bypass Windows Defender Antivirus. McAfee MVISION Endpoint 1811 Product Guide 5

6 1 Product overview How it works MVISION Endpoint includes protection against credential harvesting, and provides static and behavioral protection. McAfee cloud technologies use human and machine-learning research to analyze the latest zero-day threats. Windows Defender Antivirus management McAfee epo manages MVISION Endpoint. With MVISION Endpoint installed on your Windows 10 endpoints, McAfee epo also manages some Windows Defender Antivirus features. McAfee epo provides reporting on all Windows 10 endpoints that have Windows Defender Antivirus active, and have MVISION Endpoint installed. Windows Defender Firewall rule management MVISION Endpoint enables centralized management of Windows Defender Firewall and rule management from McAfee epo. MVISION Endpoint reports the number of blocked events on the last 24 hours from Windows Defender Firewall rules and the firewall compliance data from each managed endpoint and sends this information to McAfee epo. Management of Windows Defender Firewall and firewall rule management is switched off by default. To manage your Windows Defender Firewall and rules from MVISION Endpoint, first enable Firewall from the currently selected MVISION Endpoint General policy. Then, use the Firewall Rules policy to manage the rules. Protection Workspace The Protection Workspace dashboard enables you to monitor threats in your network, view compliance information about McAfee products, and manage devices. Protection Workspace workflows enable you to easily monitor activity and to manage your devices. View information about: Total number of devices managed by MVISION Endpoint Devices tagged as Escalated Resolved and unresolved threats Protection Workspace workflows include steps to remediate threats on your endpoints. Unified policy model Define policies for Windows Defender Antivirus and MVISION Endpoint, reducing the overhead of applying different policies. Avoid overlap between Windows Defender Antivirus and MVISION Endpoint, simplifying the management of the protection for your Windows 10 endpoints. How it works MVISION Endpoint uses cloud and local content to analyze data, and presents the information in the Protection Workspace dashboard in McAfee epo. Each protected Windows 10 endpoint needs to have the MVISION Endpoint client component installed. The MVISION Endpoint client has no interface of its own; it is not configurable by the user. The MVISION Endpoint client accepts policy from, and reports to, the McAfee epo server. 6 McAfee MVISION Endpoint 1811 Product Guide

7 Product overview How it works 1 1 Windows 10 endpoints with Windows Defender Antivirus, Windows Defender Firewall, and MVISION Endpoint client software installed. 2 McAfee epo server (on-premise, in a hosted service, or McAfee MVISION epo). 3 MVISION Endpoint sends file metadata to the McAfee cloud infrastructure for analysis. 4 When files are quarantined (by Windows Defender Antivirus or MVISION Endpoint), they are stored in the Quarantine database on the relevant endpoint. McAfee epo Quarantine then reads from these endpoint quarantine locations to enable centralized quarantine management across all your Windows 10 endpoints. 5 When enabled, firewall rules are pushed to Windows Defender Firewall on the managed Windows 10 endpoints. 6 Summaries of Windows Defender Firewall blocked events and firewall compliance data is sent to McAfee epo. Figure 1-1 How MVISION Endpoint works MVISION Endpoint provides another layer of protection, building on the detection capabilities of Windows Defender Antivirus. McAfee MVISION Endpoint 1811 Product Guide 7

8 1 Product overview How it works Figure 1-2 How MVISION Endpoint interacts with Windows Defender Antivirus As the basic anti-virus/anti-malware product, Windows Defender Antivirus protects your Windows 10 endpoints from the viruses and malware that are known. Windows Defender Antivirus passes an executable to MVISION Endpoint for further analysis only if it deems the executable to be safe. MVISION Endpoint then uses the McAfee local and cloud-based detection infrastructure for this more detailed analysis. Threat detections from Windows Defender Antivirus and MVISION Endpoint are displayed in the Protection Workspace in McAfee epo. From there, resolve the threats and change your policies to refine your protection levels. Manage any files quarantined by Windows Defender Antivirus or MVISION Endpoint from the Quarantine Management area in McAfee epo. 8 McAfee MVISION Endpoint 1811 Product Guide

9 Product overview How it works 1 Managing Windows Defender Firewall rules MVISION Endpoint lets you manage the Windows Defender Firewall rules used across your Windows 10 endpoints. Figure 1-3 How MVISION Endpoint interacts with Windows Defender Firewall With a default set of firewall rules available out-of-the-box, MVISION Endpoint enables you to quickly implement the rules and push them to all your protected endpoints. You can create rules, or change the existing ones, to build rules that meet your corporate requirements, and to push them to all your Windows 10 endpoints. Think about re-creating any previous firewall rules to make sure your levels of protection are maintained. As administrator, you can allow local firewall rules to be run on the endpoints. When using MVISION Endpoint to manage Windows Defender Antivirus or Windows Defender Firewall, it is important that you do not also use Domain Controller Group Policy or Microsoft System Center Configuration Manager (SCCM) Policy. Domain Controller and SCCM policies have higher precedence than MVISION Endpoint policies and result in the MVISION Endpoint policies being overwritten. Where conflicts arise, the Domain Controller or SCCM policies take precedence, and this results in undesirable behavior. McAfee MVISION Endpoint 1811 Product Guide 9

10 1 Product overview How it works 10 McAfee MVISION Endpoint 1811 Product Guide

11 2 Getting 2 started with MVISION Endpoint Contents About the MVISION Endpoint user interface MVISION Endpoint policies About the MVISION Endpoint user interface Find the interface for MVISION Endpoint, and see how some of these interface components are used by different McAfee products. The MVISION Endpoint client software installed on your Windows 10 endpoints includes no interface or controls that users can access. Your security administrators define the policies in McAfee epo that are then pushed to MVISION Endpoint on the endpoints. These policies include the Windows Defender Antivirus settings managed by MVISION Endpoint. Protection Workspace Protection workspace was introduced in MVISION epo, and is also available as an extension for earlier versions of McAfee epo. It provides the landing page and dashboard for MVISION Endpoint, giving you a single dashboard to view threat incidents and device compliance. Figure 2-1 Protection Workspace interface showing MVISION Endpoint data McAfee MVISION Endpoint 1811 Product Guide 11

12 2 Getting started with MVISION Endpoint MVISION Endpoint policies Quarantine Management By installing the Quarantine Management extension, you can manage quarantined files from any of your Windows 10 endpoints that are protected by MVISION Endpoint. Files quarantined by Windows Defender Antivirus and by MVISION Endpoint are managed from the Quarantine Management extension. The Quarantine Management interface is located under System Tree, adding a Quarantine Content tab to the available options under the device information. Automatic updating of client components The MVISION Endpoint Updater extension enables you to automatically keep all your endpoints up-to-date with the latest MVISION Endpoint client software and technologies. The extension adds a server task, MVISION Endpoint Update Task, to pull down the latest MVISION Endpoint software from the McAfee epo Software Catalog. By default, this task runs daily. MVISION Endpoint policies MVISION Endpoint ships with default policies. These policies, available in the McAfee epo Policy Catalog, provide templates you use to create policies that match your organizational priorities. MVISION Endpoint uses the following policy types General policies, Exclusions policies, and Firewall policies. Follow the standard McAfee epo workflow to duplicate and change these policies to meet your needs. Enabling Threat Protection and Firewall management By default, Threat Protection is enabled when you install MVISION Endpoint. We recommend that you do not disable Threat Protection, as doing so switches off the advanced malware detection features of MVISION Endpoint. To enable management of Microsoft Defender Firewall rules, enable Firewall from the MVISION Endpoint Management General <policy name> policy in the McAfee epo Policy Catalog. If Firewall is disabled in the policy, Protection Workspace reports the firewall status as being compliant, regardless of whether the Windows 10 endpoints have any firewalls enabled. 12 McAfee MVISION Endpoint 1811 Product Guide

13 Getting started with MVISION Endpoint MVISION Endpoint policies 2 General policies The software includes policies for configuring the general settings for MVISION Endpoint, including Threat Protection, Firewall, and Log Settings. For the General policy, two templates are provided, one intended as a template for general use, and one template for situations where a higher level of security is needed. The available options are the same for both, but more conservative settings are used for a higher level of security. As with all McAfee epo policies, you can duplicate and customize the settings in these default policies, using the standard McAfee epo policies workflow. See the documentation for your version of McAfee epo on docs.mcafee.com. Threat Protection Table 2-1 Threat Protection Standard options Option Protection level Definition Use the sliders to set the confidence level when McAfee takes the Block or Report actions for potential malware. The lower the confidence level, the stricter the policy, but the higher the chance of generating false-positive results. Scan Settings Update Scheduler Notifications Define the scan type, scanning schedule, and required actions for threats of differing severity for Windows Defender Antivirus. Enable Credential Theft Protection to prevent processes from reading Isass.exe memory (Isass.exe stores user credentials). Set the Update Scheduler options. Check for MVISION Endpoint updates and Windows Defender Antivirus definitions after your chosen number of hours. Check for MVISION Endpoint updates and Windows Defender Antivirus definitions at your chosen time on a recurring basis (every day, or on a specific day each week). Check for Windows Defender Antivirus definitions only. As administrator, you can decide if your users see notifications when MVISION Endpoint or Windows Defender Antivirus detects threats on the endpoint devices. Table 2-2 Threat Protection Advanced options Option Signature Update Settings Exclusions Real-Time Protection Settings What to Scan Additional Scan Settings Definition Windows Defender Antivirus can use several methods to check for and download signature updates. Select the methods to use, and drag and drop them in your preferred order. To check for signature updates from UNC files shares, enter the relevant UNC paths. Manage access to the selected folders. Select Disabled, Block, or Audit from the drop-down list. The lists of protected folders are defined in the Exclusions policy. Select the real-time protection configuration to be applied to Windows Defender Antivirus and MVISION Endpoint. Select the items that Windows Defender Antivirus and MVISION Endpoint scan. Select the settings appropriate for your requirements. McAfee MVISION Endpoint 1811 Product Guide 13

14 2 Getting started with MVISION Endpoint MVISION Endpoint policies Firewall Table 2-3 Firewall Standard options Option Basic Definition Choose the profiles that you enable the Firewall management for. Decide if the users of each profile see notifications about firewall events. Table 2-4 Firewall Advanced options Option Advanced Definition To use existing local firewall rules, select the profiles to which these rules apply. If you use the MVISION Endpoint Firewall management, and later disable it, the local firewall rules on your managed Windows 10 endpoints are automatically reactivated. Log Settings Table 2-5 Log Settings (all options) Option Log Settings across MVISION Endpoint Definition Select the information to be included in the log files. (Advanced option) Set the Log Size Limit, and the Log Level. The default settings are suitable for most customers. You can change them if you have specific requirements. For example, if you are troubleshooting an issue, select a more detailed Log Level and increase the Log Size Limit. These log settings provide more detailed information to help diagnose the issue. Exclusions policy The Exclusions policy contains a single policy template. Duplicate this policy to configure files, folders, and processes to be excluded from the MVISION Endpoint and Microsoft Windows Defender Antivirus scans. Table 2-6 Option definitions Option File and Folder Exclusions Process Exclusions File Type Exclusions Protected Folders Permitted Applications Definition Enter the folder paths to exclude folders and the files they contain from being scanned by scheduled and real-time scans. To exclude files opened by processes from being scanned, specify the paths to those processes. All files opened by the specified process are excluded from scans. To prevent scanning of specific file types by scheduled, custom, or real-time scans, add the files types to the File Type Exclusions list. Define folders where untrusted applications can't change or delete files or folders. For example, prevent untrusted applications from changing files in the Documents folder. Specify the applications to be considered as trusted, and that can change or delete files or folders in the Protected Folders list. The exclusions for Protected Folders and Permitted Applications are applied only if the General Advanced options Exclusions policy settings are set to Block or Audit. 14 McAfee MVISION Endpoint 1811 Product Guide

15 Getting started with MVISION Endpoint MVISION Endpoint policies 2 Firewall Rules MVISION Endpoint includes the ability to manage Microsoft Windows Defender Firewall rules on your Microsoft Windows 10 endpoints. As with all McAfee epo policies, you can duplicate and customize the settings in these default policies, using the standard McAfee epo policies workflow. See the documentation for your version of McAfee epo on docs.mcafee.com. Microsoft Windows Defender Firewall, by default, contains two 'top level' rules; one that blocks all inbound connections, and the other, which allows all outbound connections. To have a working system, you must set up rules to allow the inbound connections needed for your normal network connectivity. By default, MVISION Endpoint includes several firewall rules to allow the most commonly used inbound connections. Create further rules to meet your specific needs for inbound connections to your endpoints, and to also create the outbound rules of both Allow and Block types to meet your required security objectives. You can sort the default rules by clicking the column heading of any column. Table 2-7 Option definitions out-of-the-box inbound allow rules Rule Allow Network Time Protocol traffic Allow SNMP traffic Allow inbound Remote Desktop Connections (RDP) connections App Installer Connect Core Networking Cortana Delivery Optimization ICMP Mail and Calendar Microsoft Edge My Office NetBIOS Network Discovery OneNote Remote Assistance Skype VPN Win32WebViewHost Windows AD authentication Wireless Display Definition Rule for Network Time Protocol communications. SNMP traffic rule. Inbound RDP connections rule. Rule for the Microsoft App installer, allowing installation and maintenance of Apps. Rule for Microsoft PPI Projection. Rules concerned with allowing networking functions. Rule for Microsoft Cortana communications. Includes rules for TCP-In and UDP-In. Rules for Internet Control Message Protocol communications. Rule for Microsoft Windows Communication Apps. Rule for Microsoft Edge Communications with the Microsoft Office hub. Includes rules for RCP and NetBIOS sessions. Includes multiple rules for network discovery purposes. Rule for Microsoft OneNote communications. Rules for Remote Assistance channels. Skype communications rule. Rules used to enable VPN communications. Rule for Microsoft Windows 32-bit Webview host applications. Active Directory rules. Rules that apply to connections with wireless displays. McAfee MVISION Endpoint 1811 Product Guide 15

16 2 Getting started with MVISION Endpoint MVISION Endpoint policies Table 2-7 Option definitions out-of-the-box inbound allow rules (continued) Rule Work or school account Your account Definition Rule for the plug-in to allow work or home account integration. Rule for communications with Microsoft Windows cloud account logon. Options in bold contain groups of similar rules. Add a firewall rule When defining your firewall policy for your Windows 10 endpoints, you might need to add new firewall rules. You can create firewall rules that allow communications, or that block communications. These communications can be inbound or outbound, and can apply to programs, services, IP addresses, or to specific protocols or ports. Use the available options to create a rule that meets your specific needs. The following example creates a rule that blocks access from the endpoint to Skype. Task 1 From your McAfee epo interface, browse to Policy Catalog MVISION Endpoint 1811 Firewall Rules. If you only see the default Standard Firewall Rules policy, duplicate this to create an editable policy. 2 Click Edit. The policy opens, showing the existing rules. 3 From the Take action dropdown, select New Rule. The rule Details pane is displayed. 4 Type Block Skype in the rule name text box. 5 Select the options for the rule: Action: As this example rule is a block rule, select Block. Direction: For this example, select Outbound. Profile: For this example, select the Private and Public profiles. Program: Select Specified path and enter the path to the program, for example C:/Program files (x86)\microsoft\skype for Desktop\Skype.exe. Local IP/Remote IP: Set the IP addresses to Any IP address. Protocol: Set to Any. 6 Click Add. The new rule to block outgoing connections from the endpoint to Skype is added to the rules in the selected policy. So that the new rule takes effect, make sure the policy with the new rule is currently assigned to your chosen endpoints, and use Wake Up Agents to push the policies to these endpoints. Change a firewall rule When defining your firewall policy for your Windows 10 endpoints, you might need to change existing firewall rules. You can change existing firewall rules to better meet your requirements. 16 McAfee MVISION Endpoint 1811 Product Guide

17 Getting started with MVISION Endpoint MVISION Endpoint policies 2 Task 1 From your McAfee epo interface, browse to Policy Catalog MVISION Endpoint 1811 Firewall Rules. If you only see the default Standard Firewall Rules policy, duplicate this to create an editable policy. 2 Click Edit. The policy opens, showing the existing rules. 3 Select the rule to change. The rule Details pane is displayed, showing the current settings for this rule. 4 Make the changes. 5 Click Update. The Details pane closes. 6 Click Save. So that the updated rule takes effect, make sure the policy with the changed rule is currently assigned to your chosen endpoints, and use Wake Up Agents to push the policies to these endpoints. Delete a firewall rule When defining your firewall policy for your Windows 10 endpoints, you might need to delete existing firewall rules. Remove any rules that you do not want in your policy. You can't delete rules from the default (read-only) policies. Task 1 From your McAfee epo interface, browse to Policy Catalog MVISION Endpoint 1811 Firewall Rules. If you only see the default Standard Firewall Rules policy, duplicate this to create an editable policy. 2 Click Edit. The policy opens, showing the existing rules. 3 Select the rule to delete. The rule Details pane is displayed, showing the current settings for this rule. 4 From the Take action dropdown, select Delete Rule. 5 Confirm that you want to delete the selected rule. 6 Click Save. The selected rule is removed from the policy. Use Wake Up Agents to push the policies to your Windows 10 endpoints. McAfee MVISION Endpoint 1811 Product Guide 17

18 2 Getting started with MVISION Endpoint MVISION Endpoint policies 18 McAfee MVISION Endpoint 1811 Product Guide

19 3 Using 3 Protection Workspace to identify and remediate threats The Protection Workspace provides a visual representation of threat incidents in your environment and device compliance data, all from a single dashboard. You can quickly identify threats detected in the environment and seamlessly navigate to any impacted device to remediate the threat. The Protection Workspace is made up of several parts where you can view and react to threats: Threat Overview View threat information across multiple categories. View the number of escalated devices to track devices that have encountered multiple threats and might require attention. Devices are escalated automatically based on the severity of the threats impacting the system. Select any value to see a more detailed view of the categories. Compliance Overview View the status of security content and the individual products deployed in the environment. Devices are color-coded to indicate the security status (health) of the device. You can easily identify the systems that are up to date, or require an update or product deployment. Device view View your devices by tags (default), as System Tree, or as a list. Use the search feature to quickly find a device. The Devices view changes depending on the device summary you select. If you selected Escalations, the pane displays all escalated devices. Contents Using the Protection Workspace with MVISION Endpoint Getting started with the Protection Workspace Threat Event workflow example Apply Protection Workspace tags to systems Using the Protection Workspace with MVISION Endpoint The Protection Workspace is a McAfee epo component used by several McAfee products. The Protection Workspace is installed by default when using the cloud-based, multi-tenant, MVISION epo product. For the on-premise versions of McAfee epo (versions 5.3, 5.9, and 5.10), you need to manually install the Protection Workspace extensions on your McAfee epo server before you can use the Protection Workspace. Because the Protection Workspace is a shared component used by several McAfee products, some of the options and data included might not apply to MVISION Endpoint. As an example, MVISION Endpoint does not use daily DAT updates, it relies instead on Windows Defender Antivirus for the basic definition-based virus detections. So, in the context of MVISION Endpoint, the Protection Workspace Compliance Overview Security Content shows the status of your Windows Defender Antivirus installations, but does not list MVISION Endpoint, because this product does not use its own DAT files. McAfee MVISION Endpoint 1811 Product Guide 19

20 3 Using Protection Workspace to identify and remediate threats Getting started with the Protection Workspace Getting started with the Protection Workspace The Protection Workspace is where you can see all potential threats on managed devices and respond to them. The Protection Workspace is divided into several categories, allowing you to view compliance information and manage key threats in one place. When interacting with the Protection Workspace, start on the left side and progress to the right. Name Category Description Protection Workspace bar Devices Escalations Update Settings Total number of devices tracked by the McAfee epo server. Total number of devices that are tagged as escalated. Select a device to view Escalated Devices. System is escalated if it detects 5 threats or more in 24 hours. Updates automatically occur every 5 minutes. Click the refresh icon to manually redisplay the Protection Workspace. Use the Protection Workspace settings to: Change the interface to High Contrast Mode. Adjust the Security Content Color Thresholds and Check-In Failure Color Thresholds to customize the security levels for your environment. Threat Overview Compliance Overview Escalated Devices Resolved Threats Unresolved Threats Data Protection Security Content Software Status You must have the product extensions installed to see the categories. Total number of devices that received a threat over the past 7 days. System is escalated if it detects 5 threats or more in 24 hours. Total number of threats that were resolved in the past 7 days. Basic Detected by products like McAfee VirusScan Enterprise, McAfee Endpoint Security Threat Prevention, and Microsoft Windows Defender. Advanced Detected by advanced detection techniques like McAfee MVISION Endpoint, Real Protect, and McAfee Endpoint Security Adaptive Threat Protection (ATP). Total number and count per day of detected threats that are unresolved. Arrow indicates the trend over the past 7 days. Reports only the total number of McAfee Data Loss Prevention (McAfee DLP) and McAfee Management of Native Encryption (MNE) events over the past 7 days. Percentage of systems that are within a specific number of days using a current DAT. For example, If the DAT is within 3 days of release it's considered compliant, if it's older than 3 days it's noncompliant. Status of the security content and the individual products deployed in the environment. For example, McAfee Agent, McAfee MVISION Endpoint, and Microsoft Windows Defender. The devices are color-coded to indicate the health of the security status (health) of the device: Green Latest (most recent) version. Orange One or more versions behind. Light gray No data available. The extension is checked in to McAfee epo, but the product hasn't been deployed. Dark gray Indicates that the extension is checked in, but the product isn't installed on the endpoint. 20 McAfee MVISION Endpoint 1811 Product Guide

21 Using Protection Workspace to identify and remediate threats Threat Event workflow example 3 Name Category Description Device Management Status Check-in Failure indicates the number of devices that haven't checked in to the McAfee epo server for more than 15 days. Managed Devices without Protection indicates the number of devices that don't have these anti-malware products installed: Threat Prevention, MVISION Endpoint, or VirusScan Enterprise. Managed Devices indicates the total number of managed devices over the past 7 days. Devices View your devices by tags (default), in the System Tree, or as a list. Use the search feature to quickly find a device. The information that appears in the Devices pane changes depending on the category you select: Devices Escalated Devices Drill down to view the device details and the top 5 threats. Select a threat to open the Threat Details pane, and view specific details about a specific threat. Threat Event workflow example The Protection Workspace provides a snapshot of your network's security status, allowing you to view key threats so you can investigate and determine a response. 1 The Protection Workspace shows key threat events and compliance across McAfee products. 2 The security administrator quickly evaluates urgent events and escalated devices. 3 The security team investigates the escalated devices to determine a response. Apply Protection Workspace tags to systems Tag devices (systems) to escalate or exclude them from a compliance check. Task 1 In the Protection Workspace, select a device from the tag, tree, or list view. The Device Details pane opens. McAfee MVISION Endpoint 1811 Product Guide 21

22 3 Using Protection Workspace to identify and remediate threats Apply Protection Workspace tags to systems 2 From the Security State drop-down list, select a tag. 3 Click Confirm. 22 McAfee MVISION Endpoint 1811 Product Guide

23 4 Managing quarantined content You can manage quarantined content from the McAfee epo System Tree. The Quarantined Content tab, found in the System Tree for each of your configured systems, provides information about content that has been quarantined by compatible products. Use the Quarantined Content tab to view information about the files that have been quarantined. You can also release files from quarantine, restoring them, and any related registry entries, to their previous locations on the system where they were quarantined. Quarantined files have the potential to be malicious. Only restore quarantined content that you know to be safe. Contents Using the quarantined content area Viewing and handling quarantined content Using the quarantined content area The Quarantined Content area for each managed system displays information about the quarantined items from that system. Name Detection Name Type Description The name McAfee has given to the item that has been detected and quarantined by Windows Defender Antivirus or MVISION Endpoint. Use Search the Threat Library ( to learn more about the detected item. The type of item quarantined. Options include: File Registry entries Information shows if the detection is a 32-bit or 64-bit registry entry, or if it is a registry value or registry key. For detections made by Windows Defender Antivirus, the quarantined content page displays the information returned from Windows Defender Antivirus. Microsoft defines the information that is displayed, and it might change as Windows Defender Antivirus is updated. Quarantined Item Hash Path and name for the item that has been quarantined. If available, the hash value for the quarantined content. Click the hash value to look up the description of the threat on the VirusTotal information page. McAfee MVISION Endpoint 1811 Product Guide 23

24 4 Managing quarantined content Viewing and handling quarantined content Name Detection Method Event Quarantined Time Action (displayed above the table) Description How the quarantined item was detected. Options depend on the software using the Quarantine management: MVISION Endpoint Windows Defender Antivirus Possible Event options are: Section Execution The detection and quarantine occurred at the point the file was being memory mapped. Process Creation The detection and quarantine occurred after the process was loaded into memory, and the point of process execution. The time and data stamp for the quarantine event. Select the quarantined items to be handled, and select the required Action. Delete Remove the selected content from quarantine. Restore Restore the selected content to the endpoint and location where it was quarantined. Viewing and handling quarantined content Use the McAfee epo System Tree to view information about quarantined content and to take the appropriate actions on that content. You can configure your policy to automatically delete quarantined content after a specified number of days. Task 1 Identify the endpoint with quarantined content. From Protection Workspace, expand Resolved Threats, and look for endpoints that have the Action Taken set to moved. 2 Log on to McAfee epo. 3 In the System Tree, select the endpoint with the quarantined content. 4 Click the Quarantined Content tab. Information about the quarantined content for the selected endpoints is displayed. 5 Select the quarantined items to be handled, and select the required Action. Delete Remove the selected content from quarantine. Restore Restore the selected content to the endpoint and location where it was quarantined. 24 McAfee MVISION Endpoint 1811 Product Guide

25 A Managed settings Contents Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint MVISION Endpoint settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint When MVISION Endpoint is installed on Microsoft Windows 10 endpoints, MVISION Endpoint manages some of the Microsoft Windows Defender Antivirus settings. Table A-1 Microsoft Windows Defender Antivirus settings in the General policy MVISION Endpoint policy setting AllowFastServiceStartup AllowPause CheckForSignaturesBeforeRunningScan DisableArchiveScanning DisableBehaviorMonitoring Disable Scanning Description This policy setting controls the load priority for the antimalware service. Increasing the load priority allows for faster service startup but might impact performance. If you enable this setting, the antimalware service loads as a normal priority task. If you disable this setting, the antimalware service loads as a low-priority task. This policy setting allows you to manage whether end users can pause a scan in progress. If you enable this setting, a new context menu is added to the task tray icon to allow the user to pause a scan. This policy setting allows you to manage whether a check for new virus and spyware definitions occurs before running a scan. This setting applies to scheduled scans and the command line "MpCmdRun -SigUpdate", but it has no effect on scans initiated manually from the user interface. If set to 1, a check for new definitions occurs before running a scheduled scan. This policy setting allows you to configure scans for malware and unwanted software in archive files such as.zip or.cab files. If set to 1, archive files aren't scanned during an on demand or scheduled scan. Allows you to disable behavior (runtime) process monitoring for Windows Defender Antivirus and MVISION Endpoint. If set to 1, behavior monitoring doesn't monitor processes. This policy setting allows you to configure scanning. When scanning is enabled, the engine parses the mailbox and mail files, according to their specific format, to analyze the mail bodies and attachments. Several formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). If set to 1, scanning is disabled. McAfee MVISION Endpoint 1811 Product Guide 25

26 A Managed settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint Table A-1 Microsoft Windows Defender Antivirus settings in the General policy (continued) MVISION Endpoint policy setting DisableHeuristics DisableIOAVProtection DisablePackedExeScanning DisableRealtimeMonitoring DisableRemovableDriveScanning DisableRestorePoint DisableScanningMappedNetwork... DrivesForFullScan DisableScanningNetworkFiles EnableControlledFolderAccess EnableNetworkProtection Description This policy setting allows you to configure heuristics. Suspicious detections are suppressed right before reporting to the engine client. Turning off heuristics reduces the capability to flag new threats. We recommend that you do not turn off heuristics. If set to 1, heuristics is disabled. This policy setting allows you to configure scanning for all downloaded files and attachments. If set to 1, scanning for all downloaded files and attachments is disabled. This policy setting allows you to configure scanning for packed executables. It is recommended that this type of scanning remain enabled. If set to 1, packed executables aren't scanned. This policy setting turns off real-time protection for known malware detection. If set to 1, Windows Defender Antivirus doesn't block potential malware from running and doesn't disable a detection prompt. This policy setting allows you to manage whether to scan for malware and unwanted software in the contents of removable drives, such as USB drives, when running a full scan. If set to 1, removable drives aren't scanned during any type of scan. Removable drives might still be scanned during quick scan and custom scan. This policy setting allows you to create a system restore point on the computer daily before cleaning. If you disable this setting, a system restore point is created. This policy setting allows you to configure scanning mapped network drives. If set to 1, mapped network drives are scanned. This policy setting allows you to configure scanning for network files. If set to 1, network files are scanned during on demand and scheduled scans. Controlled folder access blocks untrusted applications from changing or deleting files in protected folders. It can be set to: Block: Untrusted applications cannot change or delete files in protected folders. Disabled: All applications can change or delete files in protected folders, such as the Documents folder. Audit: Applications that are normally considered "untrusted" if this setting was Enabled can still change or delete files in protected folders. Each event is recorded in the Windows event log. Windows Defender Antivirus automatically determines which applications are trusted. By default, system folders are automatically guarded. Enable or disable Windows Defender Exploit Guard network protection to prevent employees from using any application, for example, a browser, to access dangerous domains that might host phishing scams, exploit-hosting sites, and other malicious content on the Internet. It can be set to: Block: Users and applications can't access dangerous domains. Audit Mode: Users and applications can connect to dangerous domains. If this feature would had blocked access if it were set to Block, a record of the event is added to the event logs. Disabled: Users and applications aren't blocked from connecting to dangerous domains. 26 McAfee MVISION Endpoint 1811 Product Guide

27 Managed settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint A Table A-1 Microsoft Windows Defender Antivirus settings in the General policy (continued) MVISION Endpoint policy setting HighThreatSeverityDefaultAction IOAVMaxSize LowThreatSeverityDefaultAction MediumThreatSeverityDefaultAction NotificationSuppress PurgeItemsAfterDelay RandomizeScheduleTaskTimes RealtimeScanDirection Description This policy setting allows you to customize which automatic remediation actions are taken for high-level threats. Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that are scanned. This policy setting allows you to customize which automatic remediation action is taken for low-level threats. Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore This policy setting allows you to customize which automatic remediation action is taken for medium level threats. Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore Use this policy setting to specify if you want detection notifications to display on clients. If you enable this setting, Windows Defender Antivirus or MVISION Endpoint detection notifications do not display on clients. Windows Defender Antivirus notifications are only be suppressed on RS4 or higher. This policy setting defines the number of days items are kept in the Quarantine folder before being removed. Value zero means that items are kept in the quarantine folder indefinitely and aren't automatically removed. This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled definition update start time. This setting is used to distribute the resource impact of scanning. For example, it might be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time. If you enable this setting, scheduled tasks begin at a random time within an interval of 30 minutes before and after the specified start time. If you disable this setting, scheduled tasks begin at the specified start time. This policy setting allows you to configure monitoring for incoming and outgoing files, without having to turn off monitoring entirely. This configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity is present on those volumes. The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only McAfee MVISION Endpoint 1811 Product Guide 27

28 A Managed settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint Table A-1 Microsoft Windows Defender Antivirus settings in the General policy (continued) MVISION Endpoint policy setting ScanAvgCPULoadFactor ScanOnlyIfIdle ScanParameters ScanScheduleDay ScanScheduleTime ServiceKeepAlive SignatureUpdateInterval SignatureUpdatesDefinitionUpdate... FileSharesSources Description Allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers A value of 0 indicates no throttling of CPU utilization. CPU utilization doesn't exceed the percentage specified during a scheduled scan. This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use. If you enable this setting, scheduled scans only run when the computer is on but not in use, which might not be the scheduled time. This policy setting allows you to specify the scan type to use during a scheduled scan. Scan type options are: 1 = Quick Scan (default) 2 = Full Scan This policy setting allows you to specify the day of the week when to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: 0 = Every Day 1 = Sunday 2 = Monday 3 = Tuesday 4 = Wednesday 5 = Thursday 6 = Friday 7 = Saturday 8 = Never (default) This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 a.m. The schedule is based on local time on the computer where the scan is executing. This policy setting allows you to configure whether the antimalware service remains running when anti-virus and anti-spyware definitions are disabled. If you enable this setting, the antimalware service always remains running, even if anti-virus is disabled. This policy setting allows you to specify an interval at which to check for definition updates. The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day). This policy setting allows you to configure UNC file share sources for downloading definition updates. Sources are contacted in the order specified. If you enable this setting, the specified sources are contacted for definition updates. Once definition updates have been successfully downloaded from one specified source, the remaining sources in the list aren't contacted. "FileShares" needs to be specified in the SignatureUpdatesFallbackOrder setting. 28 McAfee MVISION Endpoint 1811 Product Guide

29 Managed settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint A Table A-1 Microsoft Windows Defender Antivirus settings in the General policy (continued) MVISION Endpoint policy setting SignatureUpdatesFallbackOrder SignatureUpdatesScheduleDay SignatureUpdatesScheduleTime SpynetReporting Description This policy setting allows you to define the order in which different definition update sources are contacted. Possible values are: InternalDefinitionUpdateServer MicrosoftUpdateServer MMPC FileShares Multiple can be specified. Once definition updates have been successfully downloaded from one specified source, the remaining sources in the list aren't contacted. This policy setting allows you to specify the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: 0 = Every Day 1 = Sunday 2 = Monday 3 = Tuesday 4 = Wednesday 5 = Thursday 6 = Friday 7 = Saturday 8 = Never (default) This policy setting allows you to specify the time of day at which to check for definition updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 a.m. The schedule is based on local time on the computer where the check is occurring. This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malware infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information is automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. Microsoft doesn't use this information to identify you or contact you. Possible options are: 1 = Disabled (default) 2 = Enabled Enabling this setting sends more information to Microsoft about malware, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. SubmitSamplesConsent must also be enabled for the samples to be sent. McAfee MVISION Endpoint 1811 Product Guide 29

30 A Managed settings Microsoft Windows Defender Antivirus settings managed by MVISION Endpoint Table A-1 Microsoft Windows Defender Antivirus settings in the General policy (continued) MVISION Endpoint policy setting SubmitSamplesConsent UILockdown Description This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: 0 = Always prompt 1 = Send safe samples automatically 2 = Never send 3 = Send all samples automatically This policy setting allows you to configure whether the user can set some of the Windows Defender Security Center settings. If you enable this setting, the Windows Defender Security Center interface is locked down to the user. Table A-2 Microsoft Windows Defender Antivirus settings in the Exclusions policy MVISION Endpoint setting name ControlledFolderAccessAllowed... Applications ControlledFolderAccess... ProtectedFolders Exclusions_Extensions Exclusions_Paths Exclusions_Processes Description Add additional applications to be considered "trusted" by controlled folder access. These applications can change or delete files in controlled folder access folders (ControlFolderAccessProtection must be enabled). Windows Defender Antivirus automatically determines which applications to trust. Specify additional folders to be guarded by the Controlled folder access feature. Files within these folders cannot be changed or deleted by untrusted applications. Default system folders are automatically protected. This policy setting allows you to specify a list of file types to be excluded from scheduled, custom, and real-time scanning. Each entry must be listed as a name value pair, where the name is a string representation of the file type extension (such as ".obj" or ".lib"). This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Each entry is a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "C:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself is not excluded. To exclude the process, add the process as a path exclusion. Each entry is a string representation of the path to the process image. Only executables can be excluded. For example, a process might be defined as: "C:\windows\app.exe". 30 McAfee MVISION Endpoint 1811 Product Guide

31 Managed settings MVISION Endpoint settings A MVISION Endpoint settings Settings that apply to MVISION Endpoint are listed. Table A-3 MVISION Endpoint settings in the General policy MVISION Endpoint setting AutomaticUpdateDay Description Day of the week when "Weekly" update type is selected. Possible values: Sunday = 1 Monday = 2 Tuesday = 4 Wednesday = 8 Thursday = 16 Friday = 32 Saturday = 64 AutomaticUpdateDisabled Automatic product updates are disabled if set to 1. If set to 0, Automatic updates are enabled. AutomaticUpdateHour AutomaticUpdateInterval AutomaticUpdateScheduleType The hour for Daily and Weekly updates (24-hour format). Interval in hours when selected update type is "Interval". The automatic update schedule type. These can be: Interval = 0 Daily = 1 Weekly = 2 BlockingReputationThreshold Threshold at and below which threats are blocked. These thresholds map to confidence level: 1 - High confidence 15 - Medium confidence 30 - Low confidence DisableAttackBehaviourBlocking If you set this setting to 1, ABB doesn't block Office applications from starting script interpreters. DisableBehaviorMonitoring Allows you to disable behavior (runtime) process monitoring. If set to 1, behavior monitoring doesn't monitor processes. This policy allows you to disable behavior (runtime) process monitoring. DisableDeepRemediation DisableRealtimeMonitoring DisableScriptScanning EnableCredentialTheftProtection EnableDeepRemKillSwitch Disables triggering Deep Remediation when a detection occurs. Disables all MVISION Endpoint process monitoring and scanners if set to 1. Disable AMSI (Antimalware Scan Interface) scanner. When disabled,mvision Endpoint doesn't scan scripts from PowerShell. Credential Theft Protection blocks a user or process from creating a dump of the Local Security Authority Process (lsass) process. If this setting is enabled, the user is blocked from creating a dump of the lsass process. A system restart is needed to reenable this setting if it is disabled. Completely stops Deep Remediation from monitoring the system. EnableHermineEndpointNotifications Credential Theft Protection produces a notification to the user if it detects a process reading the lsass. Enabling this setting allows the notifications to be displayed to the user (Credential Theft Protection must also be enabled). McAfee MVISION Endpoint 1811 Product Guide 31

32 A Managed settings MVISION Endpoint settings Table A-3 MVISION Endpoint settings in the General policy (continued) MVISION Endpoint setting EnableSelfProtection LogLevel LogSizeLimitMB NotificationSuppress PurgeItemsAfterDelay ReportingReputationThreshold UninstallHash UninstallSalt Description MVE install and data folders are protected from being tampered with. Level at which logs are logged. Each level logs those lower but not higher, for example, Warning logs warnings and error messages. Log levels are: 0 = None 1 = Error 2 = Warning 3 = Info 4 = Debug 5 = Trace Limits the log file size to a specified MB size before the log file rolls over. Use this policy setting to specify if you want detection notifications to display on clients. If you enable this setting, Windows Defender Antivirus or MVISION Endpoint detection notifications don't display on clients. Windows Defender Antivirus notifications are only suppressed on Microsoft Windows 10 RS4 or higher. This policy setting defines the number of days items are kept in the Quarantine folder before being removed. Value zero means that items are kept in the quarantine folder indefinitely and aren't automatically removed. Threshold at and below which threats are reported in the log and as events send to McAfee epo. Maps to confidence: 1 - High confidence 15 - Medium confidence 30 - Low confidence Can't be set higher than BlockingReputationThreshold. Hash used for uninstall password. Salt used for uninstall password. Table A-4 MVISION Endpoint settings in the Exclusions policy MVISION Endpoint policy name Exclusions_Paths Exclusions_Processes Description This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Each entry is a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "C:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C: \Windows\App.exe". This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself is not excluded. To exclude the process, add the process as a path exclusion. Each entry is a string representation of the path to the process image. Only executables can be excluded. For example, a process might be defined as: "C: \windows\app.exe". 32 McAfee MVISION Endpoint 1811 Product Guide

33 00