Cloud Workload Discovery 4.5.1

Transcription

1 Product Guide Cloud Workload Discovery For use with McAfee epolicy Orchestrator

2 COPYRIGHT 2017 Intel Corporation TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 Cloud Workload Discovery Product Guide

3 Contents Preface 5 About this guide Audience Conventions Find product documentation Product overview 7 Security management of your cloud assets made easy Key features Components and what they do Cloud Workload Discovery packages and McAfee suites Managing policies with McAfee epo 11 Cloud Workload Discovery policies on McAfee epo Where to find policies Create a firewall policy Create an assessment policy Assign custom policies to systems in your network Visualization of your cloud accounts 15 Problems with your firewall settings or traffic Viewing account properties Viewing security group information for your instance Viewing Threat Prevention details about your instance Viewing Intrusion Prevention details about your instance Viewing Application Control details about your instance Viewing Change Control details about your instance Viewing volume encryption details for your AWS instance Traffic details for your instance Instance properties Apply McAfee epo tags to VMs in your network Automatic responses Set up automatic responses Remediation 25 Install McAfee Agent on your instances Installing Threat Prevention Install McAfee Endpoint Security Install McAfee MOVE AntiVirus Multi-Platform Installing Intrusion Prevention Install McAfee Host Intrusion Prevention Installing McAfee Endpoint Security Install Application Control on your instances Install Change Control Remediate firewall rules Cloud Workload Discovery Product Guide 3

4 Contents Edit the security group rules Detach the security group from an instance Queries and reports 31 Predefined queries View default queries Create custom queries Dashboards and monitors Data Center and Public Cloud dashboards Frequently asked questions 43 Index 47 4 Cloud Workload Discovery Product Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Conventions This guide uses these typographical conventions and icons. Italic Bold Monospace Narrow Bold Title of a book, chapter, or topic; a new term; emphasis Text that is emphasized Commands and other text that the user types; a code sample; a displayed message Words from the product interface like options, menus, buttons, and dialog boxes Hypertext blue A link to a topic or to an external website Note: Extra information to emphasize a point, remind the reader of something, or provide an alternative method Tip: Best practice information Caution: Important advice to protect your computer system, software installation, network, business, or data Warning: Critical advice to prevent bodily harm when using a hardware product Cloud Workload Discovery Product Guide 5

6 Preface Find product documentation Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6 Cloud Workload Discovery Product Guide

7 1 Product 1 overview Cloud Workload Discovery discovers, imports, manages, and secures your Amazon Web Services, Microsoft Azure, and VMware vcenter virtual infrastructure using McAfee epolicy Orchestrator (McAfee epo ). Contents Security management of your cloud assets made easy Key features Components and what they do Cloud Workload Discovery packages and McAfee suites Security management of your cloud assets made easy Cloud Workload Discovery offers improved visibility and control to address the unique requirements of public cloud security. It detects and imports virtual instances, security groups, and virtual networks to the McAfee epo server. Cloud Workload Discovery provides control over cloud infrastructure and insight into the threat information across clouds. It also offers infrastructure visibility and security alerts so that you can quickly assess security issues and take immediate actions. It integrates the management feature of McAfee epo with the configured clouds, which host and manage the VMs. It synchronizes periodically with the cloud, and imports the virtual infrastructure details to McAfee epo. You can deploy the McAfee Agent to discovered instances during the discovery or after. Then, other McAfee products can be installed on these discovered instances. It has an innovative dashboard to view and monitor the security compliance of your cloud assets. You can flag systems at risk and can take corrective actions. You can view traffic flow from and to your AWS instances. It also provides traffic insights for AWS. Key features These features are important for your organization's security, protection, and performance. Visualization of your cloud workloads The user interface gives you a hierarchical view into your cloud accounts and their assets. You can view your virtual networks, templates, VNet, system information, firewall (security group), and other system information of your virtual machines (VM). Cloud Workload Discovery Product Guide 7

8 1 Product overview Key features Security posture assessment You can view potential threats and unsafe settings so that you can take appropriate actions. You can view these details in your network configuration. Security settings that include unsafe firewall settings for AWS and Microsoft Azure accounts. Systems without Threat Prevention, Change Control, Application Control, or Intrusion Prevention products installed. Security status of suspicious external connections and blocked internal connections for your AWS instances. Security group management You can view security group information of your virtual instances across your cloud accounts. You can see how many instances are associated with any firewall (security group). You can also manage these firewall (security groups) by adding, editing, or deleting rules. You can detach a firewall (security group) from an instance. Firewall audit and hardening Cloud Workload Discovery assesses your cloud configuration and flags systems, templates, and virtual networks that are at risk. You can immediately take appropriate actions and secure your assets. Easy activation of missing protection with a few clicks After visualizing your cloud account structure, and seeing which systems are at risk, you can secure your instances with a few clicks. 1 Manage your instances by installing McAfee Agent. 2 After installing the agent, you can install these McAfee products on your instances. McAfee Endpoint Security McAfee Host Intrusion Prevention for Linux McAfee Endpoint Security for Linux McAfee Application Control McAfee MOVE AntiVirus McAfee Change Control Support for VMware vcenter cloud instances View your VMware vcenter cloud infrastructure details. You can secure your instances by setting appropriate firewall policies and also by installing McAfee security products on them. Volume discovery for AWS instances View the encryption status of your AWS volumes. Network traffic visibility and threat insights for AWS instances View network traffic flow from and to the instances in your AWS cloud network configuration. You can also see the reputation of network traffic based on IP addresses, network ports, and communications protocols. This helps you to protect instances against known and emerging network-based attacks. Support for Microsoft Azure Resource Manager Discover, manage, and secure the Microsoft Azure Resource Manager virtual infrastructure with McAfee epo. 8 Cloud Workload Discovery Product Guide

9 Product overview Components and what they do 1 Cloud usage metering You can track the usage of AWS and Microsoft Azure running cloud VMs with the metering feature. The usage of VMs is tracked in the sum of CPU hours that an account uses on a monthly basis. Components and what they do Each component performs a specific function to discover, manage, and secure your cloud assets. Amazon Web Services (AWS) Collection of web services that make up the cloud computing solution offered by Amazon. Microsoft Azure Cloud computing platform and infrastructure for building, deploying, and managing applications and services through a global network of Microsoft-managed datacenters. Virtual Machines (VMs) An isolated guest operating system installation in a normal host operating system that supports both virtual desktops and virtual servers. Security Groups A virtual firewall for your instances to control inbound and outbound traffic. Network Security Groups A list of rules in Microsoft Azure cloud network that allow or deny network traffic to your instances. Azure Virtual Network A logical isolation of your Azure cloud dedicated to your subscription. AWS Virtual Private Cloud A logically isolated section of Amazon Web Services cloud to launch your AWS resources in a virtual network. Template Templates are snap shots or images using with which you can span instances in AWS and Microsoft Azure cloud. Amazon Machine Image Amazon Machine Image provides the information required to launch an instance. McAfee epo Management software that allows you to register a cloud account, so that you can import your VMs and view them. McAfee Agent The client side component providing secure communication between McAfee epo and managed products. Hypervisor (ESXi) A virtual operating platform that manages the execution of the guest operating systems. They allow multiple operating systems to run concurrently on a hosted system. ESXi are embedded hypervisors for servers that run directly on server hardware, without requiring another underlying operating system. VMware vcenter Console that manages the ESXi servers, which host the guest VMs that require protection. Cloud Workload Discovery Product Guide 9

10 1 Product overview Cloud Workload Discovery packages and McAfee suites Cloud Workload Discovery packages and McAfee suites Cloud Workload Discovery is packaged in public, hybrid, and private variants to support different cloud vendor accounts. Table 1-1 Cloud Workload Discovery packages Cloud Workload Discovery variant Cloud Workload Discovery for Public cloud Cloud Workload Discovery for Private cloud Cloud Workload Discovery for Hybrid cloud Table 1-2 McAfee suites Supported cloud vendors AWS, Microsoft Azure, and Microsoft Azure classic VMware, OpenStack VMware, OpenStack, AWS, Microsoft Azure, and Microsoft Azure classic Package names Cloud_Workload_Discovery_Public_4.5.1 Cloud_Workload_Discovery_Private_4.5.1 Cloud_Workload_Discovery_Hybrid_4.5.1 Suite McAfee Public Cloud Server Security Suite McAfee Server Security Suite Advanced McAfee Server Security Suite Essentials McAfee MOVE AntiVirus for Virtual Servers McAfee Security Suite for Virtual Desktop Infrastructure McAfee MOVE AntiVirus for Virtual Desktops Cloud Workload Discovery package Cloud Workload Discovery for Public cloud Cloud Workload Discovery for Hybrid cloud Cloud Workload Discovery for Hybrid cloud Cloud Workload Discovery for Private cloud Cloud Workload Discovery for Private cloud Cloud Workload Discovery for Private cloud 10 Cloud Workload Discovery Product Guide

11 2 Managing policies with McAfee epo Integrate and manage assessment policies using McAfee epo software. McAfee epo provides centralized policy management and enforcement of your McAfee security products and the systems where they are installed. It also provides comprehensive reporting and product deployment capabilities through a single point of control. Contents Cloud Workload Discovery policies on McAfee epo Where to find policies Create a firewall policy Create an assessment policy Assign custom policies to systems in your network Cloud Workload Discovery policies on McAfee epo The default policies fit the broadest set of customer environments. You can tune these policies to fit your environment. Cloud Workload Discovery adds these categories in the Policy Catalog. Category Assessment Rules - Firewall Assessment Rules - General Description This policy defines the firewall settings for the systems. You can set inbound rules for the systems. It also defines how the systems are flagged if they violate the specified rules. This policy defines how the systems are flagged if the products aren't installed. Assessment Rules - General has Core Protection, Full Compliance, McAfee Default, and My Default policies. Assessment Rules - Firewall has McAfee Default and My Default policies. You can use these policies as is or you can edit My Default policies. Policy Description McAfee Default Defines the out-of-the-box policy that takes effect if no other policy is applied. You can duplicate this policy, but you can't delete or change it. My Default Defines the customizable default policy for your environment. Modify this policy to create your own customized default. Core Protection Full Compliance Defines the core or important protection that you can have in your environment. Defines the strongest protection that you can have in your environment. Cloud Workload Discovery Product Guide 11

12 2 Managing policies with McAfee epo Where to find policies Where to find policies You can view and manage your firewall policies from two locations in the McAfee epo console. The Assigned Policies tab (Systems System Tree Assigned Policies tab for a selected group in the System Tree), and the Policy Catalog tab (Systems Policy Catalog). Use the Policy Catalog to: Create policies. View and edit policy information. View where a policy is assigned. View the settings and owner of a policy. View assignments where policy enforcement is disabled. Use the Assigned Policies tab to: View the available policies of a particular feature of the product. View details of the policy. View inheritance information. Edit policy assignment. Edit custom policies. Create a firewall policy Create a custom firewall policy to suit your environment. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Policy Policy Catalog, then from the Product list, select Cloud Workload Discovery. 3 From the Category list, select Assessment Rules - Firewall. 4 Select New Policy, type a name for the policy, then click OK. 5 Click the name of an editable policy. You can edit the My Default policies, or any policies that you create. McAfee Default policies aren't editable. 12 Cloud Workload Discovery Product Guide

13 Managing policies with McAfee epo Create an assessment policy 2 6 Specify which inbound firewall rules can come from which IP addresses and their severities. Option If inbound firewall rule to port Then flag as Definition Select the inbound port from the list. Select the flag value from Safe or Critical. If you don't specify a rule for a port, it is flagged as Warning. Critical alerts are flagged for unrestricted IP addresses (with suffix /0) only. For example: Policy Setting 8443 Critical Alerts flagged for: IP address x.x.x.x/0 IP address x.x.x.x/32 Flagged as critical and color-coded as red (according to the policy setting) Flagged as warning and color-coded as yellow 7 Click Save. The new policy appears in the Policy Catalog. Create an assessment policy Create a custom assessment policy to suit your environment. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Policy Policy Catalog, then from the Product list, select Cloud Workload Discovery. 3 From the Category list, select Assessment Rules - General. Cloud Workload Discovery Product Guide 13

14 2 Managing policies with McAfee epo Assign custom policies to systems in your network 4 Click the name of an editable policy. You can edit the My Default policies, or any policies that you create. McAfee Default policies aren't editable. 5 Set the product flags to Must Have, Good to Have, or Optional. If Must Have products are missing, critical alerts (red) are flagged. If Good to Have products are missing, warnings (yellow) are flagged. If Optional products are missing, no alerts are flagged. You can set these flags for Strong Security Groups, Volume Encryption, Intrusion Prevention, Threat Prevention, Application Control, and Change Control (FIM). Strong Security Groups are always set as Must Have for your AWS and Microsoft Azure accounts. You cannot change this setting for AWS and Microsoft Azure accounts. 6 Click Save. The new policy appears in the Policy Catalog. Assign custom policies to systems in your network Assign the custom policies to the systems in your network to suit your environment. When you assign custom policies to a set of systems, they are effective after the next synchronization. If you want them to be effective immediately, schedule a manual sync. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems System Tree, then select your group of systems from the hierarchy. 3 From the Assigned Policies, you can see policies assigned to these systems. Click Edit Assignment. 4 Select Break inheritance and assign the policy and settings below for Inherit from. 5 Select your custom policy from the Assigned Policy list, then specify the values for other fields. 6 Click Save. 14 Cloud Workload Discovery Product Guide

15 3 3 Visualization of your cloud accounts After configuring and registering the cloud accounts with McAfee epo, you can view your cloud account information from Menu Systems Cloud Workload Discovery. This graphical visualization of your cloud accounts enables you to see your cloud infrastructure assets and their hierarchy. The left Issues pane highlights any issues or violations on your firewall settings or your IP traffic settings. Contents Problems with your firewall settings or traffic Viewing account properties Viewing security group information for your instance Viewing Threat Prevention details about your instance Viewing Intrusion Prevention details about your instance Viewing Application Control details about your instance Viewing Change Control details about your instance Viewing volume encryption details for your AWS instance Traffic details for your instance Instance properties Apply McAfee epo tags to VMs in your network Automatic responses Problems with your firewall settings or traffic Any issues or problems you have with your firewall settings or traffic settings are listed in the Issues panel. Cloud Workload Discovery Product Guide 15

16 3 Visualization of your cloud accounts Viewing account properties You can toggle the view of critical issues or warnings. Workload Security Displays Displays the number of instances without defined security settings for Threat Prevention, Intrusion Prevention, Application Control, Change Control, or Encryption. Platform Security Displays the number of instances without defined security settings for firewall, and the ones with unencrypted volumes. Traffic Displays the number of instances with suspicious external connections or blocked internal connections. The issues panel displays the exact number of affected instances, but lists a maximum of 2000 affected instances. Viewing account properties The new Cloud Workload Discovery dashboard gives a holistic view of your cloud account and all its aspects. You can view: Accounts Workload Virtual Networks or Data Centers/Clusters Virtual Machine properties Templates or Hypervisors Accounts panel lists the cloud vendor accounts registered in McAfee epo. Select your account and you can see list of virtual networks in your account. For a VMware vcenter account, you can see the list of datacenters or clusters in the account. Select the virtual network and you can see the workloads under that virtual network. Select a datacenter or cluster to see the list of hypervisors in it. Select a hypervisor to see the list of workloads in the hypervisor. If you select the VM, you can see the security status, management status, and system properties for that VM. 16 Cloud Workload Discovery Product Guide

17 Visualization of your cloud accounts Viewing security group information for your instance 3 If you have any VMs which aren't grouped under any VPC, they are placed under Ungrouped VMs for AWS instances. You can see if the VM is managed. If it isn't managed, you can install McAfee Agent. By default, we list all virtual networks in your account, which have at least one running instance. To view all instances running or stopped in your account, select filter Show All. By default, we show Accounts Virtual Networks Workload. To expose the templates in your virtual networks, select the filter Group by Templates. All account properties are color-coded to reflect their security status. Red - Critical Yellow - Warning Templates and workloads are classified as critical or warning if they violate the security policies. This is determined by your policy definitions in the McAfee epo Policy Catalog. If your virtual network has any instance or template that violates the security policies, it is classified as critical and color-coded red. Viewing security group information for your instance View all security groups associated with this instance. Based on the enterprise rules set, the status is either red or yellow. Select View details to view more information of your security groups. Cloud Workload Discovery Product Guide 17

18 3 Visualization of your cloud accounts Viewing Threat Prevention details about your instance Table 3-1 Firewall (Security Groups) Property Security Groups ID Association Definition Displays the name of the security or network security group. Displays the ID of the security or network security group. Displays the number of instances associated with this security group or the network security group. Some VMs in Microsoft Azure accounts might not be associated with any security groups. To view the rules in each security group, click Edit or double-click the security group. Table 3-2 Rules Property Name Associated Instances Type Protocol Port range Priority Definition Name of the security group rule. For Azure instances, every security group rule has a name. Not applicable for AWS instances. Displays other instances that are associated with this security group (firewall). Displays the Protocol type, which you can change. Displays the protocol allowed. Displays the port range allowed. Displays the priority of this rule in the security group. Priority applies only to Microsoft Azure Network Security Groups. Access Source Displays if this is allow rule or deny rule for Microsoft Azure instances. You can't edit deny rules. Deny rules aren't assessed. Displays the source IP address. You can choose Anywhere to allow connections from all traffic or Custom IP to provide an IP address that you want to allow. For AWS instances, you can also provide the security group for which you want to allow traffic. Viewing Threat Prevention details about your instance You can see if your instance has McAfee anti-malware software such as McAfee VirusScan Enterprise, McAfee Endpoint Security, and McAfee MOVE AntiVirus (Multi-Platform or Agentless) installed and configured. Your instance is color-coded and classified according to the anti-malware policy that you set in the McAfee epo Policy Catalog. When checking for the presence of anti-malware software, the results depend on the cloud environment and operating system. Cloud Windows Linux Public cloud (AWS and Azure) McAfee VirusScan Enterprise McAfee Endpoint Security McAfee VirusScan Enterprise for Linux McAfee Endpoint Security Private cloud (VMware vcenter) McAfee MOVE AntiVirus (Multi-Platform or Agentless) McAfee Endpoint Security McAfee VirusScan Enterprise for Linux McAfee MOVE AntiVirus (Agentless) McAfee Endpoint Security for Linux Depending on the Threat Prevention products installed, you can view these product properties. 18 Cloud Workload Discovery Product Guide

19 Visualization of your cloud accounts Viewing Intrusion Prevention details about your instance 3 Product McAfee Endpoint Security McAfee Endpoint Security for Linux McAfee VirusScan Enterprise Properties On-Access General On-Access ScriptScan On-Access General Access Protection On-Access General On-Access ScriptScan Buffer Overflow Detection Detection McAfee VirusScan Enterprise for Linux On-Access General McAfee MOVE AntiVirus Multi-Platform System Status McAfee MOVE AntiVirus Agentless You can: Agentless Anti-Malware Protection Status See if any properties are enabled or disabled. For details, see the product guides for the anti-malware products. Install McAfee Endpoint Security on your instances. Install McAfee MOVE AntiVirus (Multi-Platform) for your vcenter instances. Tag this system with the McAfee epo tags related to product deployment tasks. See the product guide for your version of McAfee epo. See also Apply McAfee epo tags to VMs in your network on page 22 Viewing Intrusion Prevention details about your instance Your instance is color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog. Cloud Workload Discovery checks for the presence of McAfee Host Intrusion Prevention on Windows and Linux instances on public and private cloud. Cloud Workload Discovery also checks for the presence of McAfee Endpoint Security on Windows systems on private cloud. If McAfee Host Intrusion Prevention is installed, you can see these product properties. IPS Status NIPS Status Firewall Status If McAfee Endpoint Security is installed, you can see these product properties. Access Protection Exploit Prevention For details, see the product guide for McAfee Host Intrusion Prevention or McAfee Endpoint Security. Cloud Workload Discovery Product Guide 19

20 3 Visualization of your cloud accounts Viewing Application Control details about your instance Viewing Application Control details about your instance You can see if your instance has McAfee Application Control software installed. Your instance is color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog. You can see if McAfee Application Control is installed and enabled on the instance. For details, see the product guide for McAfee Application Control. Viewing Change Control details about your instance You can see if your instance has McAfee Change Control software installed. Your instance is color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog. You can see if Change Control is installed and enabled on the instance. For details, see the product guide for McAfee Change Control. Viewing volume encryption details for your AWS instance You can view if your AWS volumes encrypted or not and also the number of your root and data volumes for your instances. Though both root and data volumes are shown, only data volumes are assessed for your AWS instances. Your instances are color-coded and classified according to the policy that you set in the McAfee epo Policy Catalog for volume encryption. You can view these details for your volumes. Property Status Type ID Size Definition Displays the encryption status of the volumes Displays the type of the volume (root or data volume) Displays the volume ID Displays the size of the volume Traffic details for your instance You can view the number of blocked internal connections and suspicious external connections to and from your instance. You can also see the number of ports that were active. The traffic displayed here is the data accumulated from a week or from the time you install your extension which ever is the earliest. The traffic records are retained in McAfee epo for seven days. On the AWS management console, we enable VPC flow log service and create a log file with the name log_mcafee_regionname for a particular region. You can view this log file from your VPC under the Flow Logs section on the AWS management console. 20 Cloud Workload Discovery Product Guide

21 Visualization of your cloud accounts Traffic details for your instance 3 Click View details to see traffic properties. Property Definition Traffic Status Direction Displays the number of blocked, inbound, and outbound connections to this instance. Displays if this traffic is blocked or allowed. Displays if the traffic is Inbound (N-S), Outbound (N-S), Inbound (E-W), Outbound (E-W), Bi-Directional (E-W), Bi-Directional (N-S). N-S indicates external traffic and E-W indicates internal traffic. From/To Port Protocol Displays the source IP address or the destination IP address for the traffic to this instance. If there are multiple IPs, you can expand the row and view all IP addresses. Displays the port number. Displays the protocol name. If any instance receives traffic from multiple IP addresses from the same port, protocol, status, and direction, the From/To field lists multiple IP addresses. You can view the different IP addresses by generating a report from Queries and Reports. You can unblock your internal connections and block your external connections by remediating your security groups. Click Firewall (Security Groups) to open the security groups associated with this instance. See also Create custom queries on page 34 Remediate firewall rules on page 29 Cloud Workload Discovery Product Guide 21

22 3 Visualization of your cloud accounts Instance properties Instance properties View the properties of your virtual systems from your cloud account. Property Location Instance ID Instance Name Instance Type Platform Private DNS Name Private IP Address Public DNS Name Public IP Address McAfee epo Managed Virtual Network ID Power Status McAfee epo Tags Definition Displays the region of the instance as shown in your cloud account. Displays the instance ID as shown in your cloud account. Displays the instance name as shown in your cloud account. Displays the hardware configuration selected for an instance when launching the instance. Displays whether the platform is Microsoft Windows or Linux. Displays the private DNS name from the cloud account. Displays the private IP address from the cloud account. Displays the Public DNS name from the cloud account. Displays the public IP address from the cloud account. Displays if this instance is managed by McAfee epo. Displays the ID of the Virtual network of this instance. Displays if this instance is running or if it is stopped. Displays McAfee epo tags for this instance. See also Apply McAfee epo tags to VMs in your network on page 22 Apply McAfee epo tags to VMs in your network Tags are used to identify and sort systems. They can also be used to select groups of systems and simplify the creation of tasks and queries. Task 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select a VM from Accounts Virtual Networks Templates Workload. 4 On the Summary pane, click Add Tag. 5 Specify a name for your tag and click the green checkmark. For details about managing tags, see the product documentation for your version of McAfee epo. Automatic responses Configure your McAfee epo server to trigger an action in response to critical or warning issues. Set automatic responses from Menu Automation Automatic Responses if you want a notification sent to you. The standard templates for Cloud Workload Discovery are: 22 Cloud Workload Discovery Product Guide

23 Visualization of your cloud accounts Automatic responses 3 Noncompliant critical workloads for AWS and Azure Noncompliant warning workloads for AWS and Azure Noncompliant critical workloads for vsphere Noncompliant warning workloads for vsphere You can set up responses for other events also as needed. Set up automatic responses Configure McAfee epo server to receive automatic responses through . Before you begin Specify the SMTP server name and the SMTP server port in Server from Menu Configuration Server Settings. For details about automatic responses and specifying the server, see the product guide for your version of McAfee epo. Task For details about product features, usage, and best practices, click? or Help. 1 Click Menu Automation Automatic Responses. 2 Select Preset as Cloud Workload Discovery. 3 Click New Response or click Edit next to an existing template. 4 On the Description page, type a unique name and any notes for the rule, if you are creating a template. 5 In the Event field, select: Event Group Cloud Workload Discovery Event Type Critical Issues or Warning Issues. 6 Click Next. 7 On the Filter page, select: Account Name Filter the cloud account name. Datacenter Filter the datacenter name. This is applicable for vsphere. epo Tags Filter McAfee epo tags assigned to instances. Instance ID Filter AWS or Azure workload ID. Issue Subtype Select any option from the drop-down list. Issue Type Select any option from the drop-down list. Platform Filter the operating system running on the instance. Region Filter the region. Type the name of the region or the location of the instance. For example, if you want instances in the ap-southeast-1 location, type ap-southeast-1/asia Pacific (Singapore). UUID Filter UUID of the vsphere workload. Vendor Type Filter the cloud service provider. Type AWS, Azure, or vsphere. Cloud Workload Discovery Product Guide 23

24 3 Visualization of your cloud accounts Automatic responses 8 Click Next. 9 Define when the event triggers the rule on the Aggregation page. For details, see Set thresholds for the rule in the McAfee epolicy Orchestrator Product Guide. 10 Click Next. 11 On the Actions page, compose the and select the recipients. For details, see Configure the action for Automatic Response rules in the McAfee epolicy Orchestrator Product Guide. 12 On the Summary page, verify the information, then click Save. The new response template for Cloud Workload Discovery appears in the Automatic Responses list. 24 Cloud Workload Discovery Product Guide

25 4 4 Remediation After viewing your cloud accounts, and seeing which systems are at risk, activate missing protection by installing McAfee products and correcting firewall settings. 1 Manage your instances by installing McAfee Agent. 2 After installing McAfee Agent, you can install other McAfee products. Contents Install McAfee Agent on your instances Installing Threat Prevention Installing Intrusion Prevention Install Application Control on your instances Install Change Control Remediate firewall rules Install McAfee Agent on your instances To manage your unmanaged instances with McAfee epo, install McAfee Agent. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 From McAfee epo Management, select Install McAfee Agent from the Take Action combo box. See KB85233 for details to install McAfee Agent on your instances using deployment URL. 5 Do one of the following: Enter the Logon Credentials Use the Deployment URL Cloud Workload Discovery Product Guide 25

26 4 Remediation Installing Threat Prevention 6 Use the option Regenerate URL to generate a new deployment URL if the Agent Handler setting for that group has changed or if you want to use a new URL for your requirements. For example, if you want to share a different URL to different people to check whether they downloaded, installed, or not installed. To avoid regenerating multiple URLs, you can delete or disable the old URLs from the System Tree. If the URL is disabled, a new URL is generated and displayed. 7 Click Install. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Installing Threat Prevention Protect your instance by installing McAfee Endpoint Security, Endpoint Security for Linux, or McAfee MOVE AntiVirus. Depending on the cloud environment and the operating system, you can install these McAfee anti-malware software. Cloud Windows Linux Public cloud (AWS and Azure) Endpoint Security Endpoint Security for Linux Private cloud (VMware vcenter) McAfee MOVE AV Multi-Platform Endpoint Security Endpoint Security for Linux Install McAfee Endpoint Security Protect your instance by installing Endpoint Security or Endpoint Security for Linux. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. You can't install Endpoint Security from Cloud Workload Discovery if McAfee Host Intrusion Prevention, McAfee VirusScan Enterprise, or McAfee MOVE AntiVirus is installed on your instances. If Host Intrusion Prevention and Endpoint Security are installed, Cloud Workload Discovery checks for the presence of Endpoint Security and its properties. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 Select Security Threat Prevention and click Install ENS or Install Threat Prevention. Endpoint Security is installed on Windows Workloads, and Endpoint Security for Linux is installed on Linux workloads. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it is timed out after 60 minutes. 26 Cloud Workload Discovery Product Guide

27 Remediation Installing Intrusion Prevention 4 Install McAfee MOVE AntiVirus Multi-Platform Protect your VMware vsphere instance by installing McAfee MOVE AV. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts DataCenters/Clusters Hypervisors Workload. 4 Select Security Threat Prevention and click Install MOVE MP. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it is timed out after 60 minutes. Installing Intrusion Prevention Protect your instance by installing McAfee Host Intrusion Prevention or McAfee Endpoint Security. Depending on the cloud environment and the operating system, you can install these McAfee products. Cloud Windows Linux Public cloud (AWS and Azure) Endpoint Security Host Intrusion Prevention for Linux Private cloud (VMware vcenter) Endpoint Security Host Intrusion Prevention for Linux Install McAfee Host Intrusion Prevention Protect your instance running Linux by installing Host Intrusion Prevention. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 Select Security Intrusion Prevention and click Install Intrusion Prevention. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Cloud Workload Discovery Product Guide 27

28 4 Remediation Install Application Control on your instances Installing McAfee Endpoint Security Protect your instance running Windows by installing Endpoint Security. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 Select Security Intrusion Prevention and click Install Intrusion Prevention. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Install Application Control on your instances Protect your instance by installing McAfee Application Control. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Make sure you have the appropriate license before installing this product. See the product guide for Application Control before installing this product. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 Select Security Application Control and click Install Application Control. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Application Control is activated in Observe Mode for your windows workloads. The Windows workloads aren't restarted and all features except Memory Protection are available. Memory protection is available after restarting your instance. 28 Cloud Workload Discovery Product Guide

29 Remediation Install Change Control 4 Install Change Control Protect your instance by installing McAfee Change Control. Before you begin Install McAfee Agent on your unmanaged instances to manage them with McAfee epo. Make sure that you have appropriate license before installing this product. See the product guide for McAfee Change Control before installing this product. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select Menu Systems Cloud Workload Discovery. 3 Select your workload from Accounts Virtual Networks Templates Workload. 4 Select Security Change Control and click Install Change Control. You can see the installation status on the Systems page. If your McAfee epo server doesn't receive installation status, it times out after 60 minutes. Remediate firewall rules To protect and secure your cloud instances that are classified as red, correct the firewall rules. You can correct the firewall settings from: Policy Catalog: See Where to find policies. Issues: Select Menu Systems Cloud Workload Discovery Issues Security Unsafe Firewall Settings, select a system, then select Security Security Groups View details. Accounts Virtual Networks, then select a VM. You can view and correct the firewall rules from Security Security Groups View details. For AWS instances, Select Accounts Virtual Networks Workloads, then select a VM. You can view and correct the firewall rules from Traffic View details Firewall (Security Groups). Tasks Edit the security group rules on page 29 Change the rules in your security group policy and secure your critical instances. Detach the security group from an instance on page 30 To secure your critical systems, remove the association of the security group to your AWS instance. Edit the security group rules Change the rules in your security group policy and secure your critical instances. Cloud Workload Discovery Product Guide 29

30 4 Remediation Remediate firewall rules Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select the critical system and its security group policy from: Menu Systems Cloud Workload Discovery Issues Security Unsafe Firewall Settings Menu Systems Cloud Workload Discovery Accounts Virtual Networks Workloads then select a VM. Select Security Firewall (Security Groups) 3 Click View details to see security groups, select one, and click Edit to edit the security group policy. A red dot highlights the noncompliant rules. 4 Edit the security group rules by changing Type, Protocol, Port range, or Source. For Microsoft Azure instances, you cannot edit rules that have Access as Deny. 5 While editing Source, you can choose Anywhere to allow connections from all traffic or Custom IP to provide an IP address that you want to allow. For AWS instances, you can also provide the security group for which you want to allow traffic. 6 To add a rule, select Add rule and type in the values. 7 To delete a non-complaint rule, click the delete icon. 8 Click Apply Changes. You can see the action details for edit, delete, update, or add in Menu User Management Audit Log. Detach the security group from an instance To secure your critical systems, remove the association of the security group to your AWS instance. If your workload has only one security group associated with it, you can't detach it. A security group which is associated with this workload can also be associated with many NICs. You can't detach a security group if it is the only security group associated with a NIC. You can detach a security group only from your AWS instances. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to McAfee epo as an administrator. 2 Select the critical system and its security group policy from: Menu Systems Cloud Workload Discovery Issues Security Unsafe Firewall Settings Menu Systems Cloud Workload Discovery Accounts Virtual Networks Workloads then select a VM. Select Security Firewall (Security Groups) 3 Click View details to see security groups associated with this instance. 4 Select one of them and click Detach to detach the security group policy form this instance. You can see the detach failure or success details in Menu User Management Audit Log. 30 Cloud Workload Discovery Product Guide

31 5 5 Queries and reports With Cloud Workload Discovery, you can quickly generate a summary view of all registered datacenters. The predefined queries and dashboards provide out of the box functionality, because they are added to your McAfee epo server when the software is installed. You can configure these queries to display results in charts or tables, which you can use as dashboard monitors. Query results can be exported to several formats, which you can download or send as an attachment to an message. You can view the list of predefined queries for the datacenters from Queries and reports McAfee Groups Data Center. You can view the list of predefined queries for the public cloud accounts from Queries and reports McAfee Groups Public Cloud. Contents Predefined queries Create custom queries Dashboards and monitors Predefined queries You can use predefined queries as is, edit them, or create queries from events and properties stored in the McAfee epo database. To create custom queries, your assigned permission set must include the ability to create and edit private queries. Cloud Workload Discovery Product Guide 31

32 5 Queries and reports Predefined queries Data Center provides these predefined queries: Query Anti-Malware Status Application Reputation AV Protection by Product Security Incidents (last 14 days) Data Centers File Integrity Monitoring Status Host Firewall Status OS Distribution Usage Metering Report Definition Specifies whether the system is in one of these states: Application Control Enabled These VMs have McAfee Application Control installed and enabled. Only Anti-Virus Enabled These VMs have a McAfee anti-malware product installed and enabled. Unprotected These VMs don't have any McAfee anti-malware product enabled. Categorizes the applications based on McAfee Global Threat Intelligence (McAfee GTI) file reputation: Good Bad Unclassified For details about file reputation, see the product documentation for McAfee Application Control. Displays the anti-virus protection status of McAfee products. Displays the events reported for these components on the VMs in the last 14 days. Antivirus Firewall Memory Protection Displays all registered datacenters. Displays the number of VMs with File Integrity Monitoring (FIM) installed and enabled. For details about FIM, see the product documentation for McAfee Change Control. Specifies whether the system is in one of these states: Firewall Enabled These VMs have McAfee Host Intrusion Prevention (McAfee Agent-based) installed. Not in use These VMs don't have McAfee Host Intrusion Prevention (McAfee Agent-based) installed. The OS Type shows the template value selected while creating the VMs. But, it might not be the actual operating system installed on the VM. Displays the usage of cloud accounts in number of hours per month. CPU cores->usage Month Specifies if the CPU cores used are single, dual, or quad core plus, and the usage month. Sum of: Hours used Specifies the sum of usage hours. 32 Cloud Workload Discovery Product Guide

33 Queries and reports Predefined queries 5 Query Endpoint Scan Report Definition Displays the details of the last scan of the endpoints. Best Practice: To get accurate data in this report, first run the Data Center: Compute Endpoint Reports server task from Menu Automation Server Tasks. Endpoint Displays the name of the endpoint. IP Address Displays the IP address of the endpoint. Category Displays the group/resource pool/host of the endpoint. Operating System Displays the operating system details. Last Scan Displays the last on-demand scan time for an endpoint with anti-virus software. Endpoint Security Report Displays the protection status of the endpoints. Best Practice: To get accurate data in this report, first run the Data Center: Compute Endpoint Reports server task from Menu Automation Server Tasks. Endpoint Displays the name of the endpoint. IP Address Displays the IP address of the endpoint. Virtual Specifies whether the endpoint is a virtual system. VM Classification Specifies if the VM is a part of public (Cloud Machine) or private (Virtual Machine) cloud. Vendor Displays the name of the cloud service provider of the endpoint. Power Status Specifies the power status of the endpoint. Category Displays the group/resource pool/host of the endpoint. Operating System Displays the operating system details. AntiVirus/Antimalware Displays the name of the McAfee anti-virus and anti-malware software installed on the endpoint. Firewall Displays the name of the McAfee software with the firewall protection active on the endpoint. Whitelisting Specifies whether the whitelisting feature is enabled. Access Protection Displays the name of the McAfee software that provides access protection. Memory Protection Displays the name of the McAfee software that provides memory protection. Last Communication Displays the time details of the last server-client communication. Instance Assessment Status Data Protection per Cloud VM Displays the number of instances that are classified as critical and the number of instances that are classified as warning. Displays the number of VMs that are encrypted and not encrypted. View default queries To generate reports based on datacenter components, run the predefined queries. Cloud Workload Discovery Product Guide 33

34 5 Queries and reports Create custom queries Task For details about product features, usage, and best practices, click? or Help. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Reporting Queries & Reports. 3 From the Groups pane, select Data Center to display the queries for the selected group. Reports are grouped under McAfee Groups. 4 From the Queries list, select a query, then click Run. 5 In the query results page, click any item in the results to drill down. 6 Click Close when finished. Create custom queries You can create custom queries that retrieve and display the details related to the Usage Metering Report and network traffic reports. With this wizard, you can configure which data is retrieved and displayed, and how it is displayed. Before you begin You must have administrator rights to perform this task. Task For details about product features, usage, and best practices, click? or Help. 1 Log on to the McAfee epo server as an administrator. 2 Select Menu Reporting Queries & Reports, then click Actions New to open the Query Builder wizard. 3 To view Usage Metering records, Select Public Cloud on the Feature Group list and on the Result Type page, select Usage Metering records, then click Next. If you upgraded from to this version, you can also see Usage Metering Report- Legacy to view the old usage metering reports. 4 To view network traffic reports for your AWS instances, select Data Center on the Feature Group list, and on the Result Type page, select Amazon Network Traffic Logs, then click Next. 5 Select the type of chart or table to display the primary results of the query, then click Next to open the Columns page. If you select Boolean Pie Chart, you must configure the criteria to include in the query. 6 Select the columns to include in the query, then click Next to open the Filter page. If you had selected Table on the Chart page, the columns you select here are the columns of that table. Otherwise, these are the columns that make up the query details table. 7 Select properties to narrow the search results, then click Run. The Unsaved Query page displays the results of the query, which is actionable. You can take any available actions on items in any tables or drill-down tables. Selected properties appear in the 34 Cloud Workload Discovery Product Guide

35 Queries and reports Dashboards and monitors 5 content pane with operators that can specify criteria to narrow the data that is returned for that property. If the query doesn't return the expected results, click Edit Query to go back to the Query Builder and edit the details of this query. If you don t want to save the query, click Close. If this is a query you want to use again, click Save and continue to the next step. 8 On the Save Query page, type a name for the query, add any notes, and select one of these options: New Group Type the new group name and select whether the group is private or public. Existing Group Select the group from the list of Shared Groups. 9 Click Save. Dashboards and monitors Dashboards, which are made up of monitors, help you track key metrics from all data center products. Reports are grouped under McAfee Dashboards at Menu Queries and reports Groups. Data Center and Public Cloud dashboards The Data Center and the Public Cloud dashboards are added to your McAfee epo server when you install the software. The Data Center dashboard displays a collection of monitors based on the results of the default datacenter queries. The Public Cloud dashboard displays the collection of monitors for default public cloud account queries. The data in these monitors on the dashboard is refreshed every 15 minutes. The default monitors that appear under these dashboards are: Data Centers Displays all registered datacenters. Cloud Workload Discovery Product Guide 35

36 5 Queries and reports Dashboards and monitors OS Distribution Displays the operating system type. It shows the template value selected while creating the VMs. But, it might not be the actual operating system installed on the VM. Security Incidents (last 14 days) Specifies events reported for these components on the VMs in the last 14 days. Application Control Antivirus Firewall Memory Protection 36 Cloud Workload Discovery Product Guide

37 Queries and reports Dashboards and monitors 5 Anti-Malware Status Displays the state of the VM. Application Control Enabled These VMs have McAfee Application Control installed and enabled. Only Anti-Virus Enabled These VMs have a McAfee anti-virus product installed and enabled. Unprotected These VMs don't have any McAfee anti-malware product enabled. Host Firewall Status Displays the state of the system. Firewall Enabled These VMs have McAfee Host Intrusion Prevention installed. Not in use These VMs don't have McAfee Host Intrusion Prevention installed. Cloud Workload Discovery Product Guide 37

38 5 Queries and reports Dashboards and monitors File Integrity Monitoring Status Displays the number of VMs with File Integrity Monitoring (FIM) installed and enabled. Enabled File Integrity Monitoring is enabled on these VMs. Not enabled File Integrity Monitoring is disabled on these VMs. Not installed File Integrity Monitoring isn't installed on these VMs. For more details about FIM, see the product documentation for McAfee Change Control. Instance Assessment status Displays the number of instances that are classified as critical and the number that are classified as warning. 38 Cloud Workload Discovery Product Guide

39 Queries and reports Dashboards and monitors 5 Data protection per Cloud VM Displays the number of VMs that are encrypted versus the number of VMs that aren't encrypted. Encrypted These VMs are encrypted. Not Encrypted These VMs aren't encrypted. Usage Metering Report Displays the usage of running AWS and Microsoft Azure cloud instances, in number of hours per month. You can see how many hours are used by your single core, dual core, and your quad-core instances for every month. Cloud Workload Discovery Product Guide 39

40 5 Queries and reports Dashboards and monitors Application Reputation Categorizes the applications based on McAfee Global Threat Intelligence file reputation. Good Bad Unclassified This dashboard retrieves data from the McAfee Application Control extension. For details about file reputation, see the product documentation for McAfee Application Control. Endpoint Scan Report Displays the last scan details of the endpoints. This report is run every eight hours. Endpoint Displays the name of the endpoint. IP Address Displays the IP address of the endpoint. Category Displays the group/resource pool/host of the endpoint. Operating System Displays the operating system details. Last Scan Displays the last on-demand scan time for an endpoint with different anti-virus software. Best Practice: To get accurate data in this report, first run the Data Center: Compute Endpoint Reports server task from Menu Automation Server Tasks. Endpoint Security Report Displays the protection status of the endpoints. This report is run every eight hours. Endpoint Displays the name of the endpoint. IP Address Displays the IP address of the endpoint. Virtual Specifies whether the endpoint is a virtual system. VM Classification Specifies if the VM is a part of public (Cloud Machine) or private (Virtual Machine) cloud. 40 Cloud Workload Discovery Product Guide