McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

Transcription

1 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, Virus are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

3 Contents 1 Migrated policies and their equivalent settings 5 General policy Troubleshooting and Advance tab policy General tab policy Detections tab policy Advanced tab policy Actions tab Migrated settings from Host Intrusion Prevention to Endpoint Security for Linux Error codes 11 Exit codes Managing software on McAfee epo and Cloud 13 Access Protection page Add or Edit rule page User page Subrule page Subrule target page Add or Edit Exclusion page Queries for Threat Prevention Queries for Access Protection Other queries McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 3

4 Contents 4 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

5 1 Migrated policies and their equivalent settings After migrating policies and settings from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux, you can view the migrated settings in the respective options. Contents General policy Troubleshooting and Advance tab policy General tab policy Detections tab policy Advanced tab policy Actions tab Migrated settings from Host Intrusion Prevention to Endpoint Security for Linux General policy Troubleshooting and Advance tab Here is the list of General Policies > Troubleshooting and Advance tab settings migrated from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux Threat Prevention. Troubleshooting tab In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Policy Category Title Options General policies Troubleshooting Log detail level Low Normal High Common > Options Client Logging > Activity Logging Enable activity logging Additionally log to SYSLOG Limit age of log entries Maximum age of log entries Detail level for SYSLOG Common > Options Activity Logging Log events to Windows Event Log or syslog Limit size (MB) of each of the activity log files Not Applicable Advance tab In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Policy Category Title Options General policies Advance Disable client Web UI Not Applicable Turn off SMTP Notifications Detail level for SYSLOG Not Applicable McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 5

6 1 Migrated policies and their equivalent settings policy General tab policy General tab Here is the list of policy General tab policy settings migrated from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux settings. In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Category Title Options ning policy ning policy General On-access scan Enable on-access scanning General Maximum Time Enable Quarantine Directory Common Options Quarantine folder Enforce maximum scanning time for all files Maximum scan time (seconds) Specify maximum number of seconds for each file scan policy Detections tab Here is the list of policy Detections tab settings migrated from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux. In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Category Title Options ning policy ning policy ning policy Detections files When writing to disk Process Settings > ning When to scan Detections Detections What to scan What not to scan When reading from disk On network mounted volume Process Settings > ning When to scan > ning All files Process Settings > ning What to scan Default + additional file types Process Settings > ning What to scan Specified file types Process Settings > ning What to scan Select files and directories to be excluded from virus scanning Process Settings > Exclusions When writing to disk When reading from disk On network drives All files Default and specified file types Specified file types only 6 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

7 Migrated policies and their equivalent settings policy Advanced tab 1 policy Advanced tab Here is the list of policy Advanced tab settings migrated from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux. In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Category Title Options ning policy ning policy ning policy Advanced Heuristics Find unknown program viruses Find unknown macro viruses Advanced Non-viruses Find potentially unwanted programs Advanced Compressed files Find joke programs inside multiple-file archives (e.g..zip Decode MIME encoded files Process Settings > Additional scan options Process Settings > Additional scan options Process Settings > Additional scan options Process Settings > Additional scan options Process Settings > ning What to scan Process Settings > ning What to scan Detect unknown program threats Detect unknown macro threats Detect unwanted program threats Detect unwanted program threats Compressed archive files Compressed MIME-encoded files policy Actions tab Here is the list of policy Actions tab settings migrated from McAfee Virus Enterprise for Linux to McAfee Endpoint Security for Linux. In McAfee Virus Enterprise for Linux In McAfee Endpoint Security for Linux Category Tab Title Options Category Title Options ning policy Actions When Viruses and Trojans are found If the above action fails Deny access to infected files and continue Move infected files to the quarantine directory (configured in General tab) Delete infected files automatically Rename infected files automatically Clean infected files automatically No secondary options available for this action Actions> Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > If the first Deny access to files Delete files Clean files McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 7

8 1 Migrated policies and their equivalent settings policy Actions tab In McAfee Virus Enterprise for Linux When Programs & Jokes are found If the above action fails If scanning fails Deny access to infected files and continue Move infected files to the quarantine directory (configured in General tab) Delete infected files automatically Rename infected files automatically Deny access to infected files and continue Move infected files to the quarantine directory (configured in General tab) Delete infected files automatically Rename infected files automatically Clean infected files automatically No secondary options available for this action Deny access to infected files and continue Move infected files to the quarantine directory (configured in General tab) Delete infected files automatically Rename infected files automatically Allows access to the file Deny access to the file In McAfee Endpoint Security for Linux Actions > If the first Actions > If the first Actions > If the first Actions > If the first Actions > Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > Threat detection first response Actions > If the first Actions > If the first Actions > If the first Actions > If the first Actions > If the first Actions> If the first Actions > If the first Deny access to files Delete files Deny access to files Deny access to files Allows access files Deny access to files 8 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

9 Migrated policies and their equivalent settings Migrated settings from Host Intrusion Prevention to Endpoint Security for Linux 1 In McAfee Virus Enterprise for Linux If scanning times out Allows access to the file Deny access to the file In McAfee Endpoint Security for Linux Actions Actions Allows access to files Deny access to files Migrated settings from Host Intrusion Prevention to Endpoint Security for Linux Here is the list of settings migrated from Host Intrusion Prevention to McAfee Endpoint Security for Linux Threat Prevention. Comparing Host Intrusion Prevention and Endpoint Security for Linux Access Protection settings In Host Intrusion Prevention In Endpoint Security for Linux Category Tab Title Options Policy Category Title IPS Rules Signatures Signature name Subrules Access Protection Rules > Name Severity Access Protection Rules > Block and Report Log Status Access Protection Rules > Report Notes Access Protection Rules > Notes Standard IPS Subrule Properties Rule Type >Files > Operations >Change permissions Rule Type >Files > Operations >Remove Directory and Delete Access Protection Access Protection Rules > Linux Rule > Linux Subrule > Change permissions Rules > Linux Rule > Linux Subrule > Delete Rule Type >Files > Operations > Create directory and Create Rule Type >Files > Operations >Read Rule Type >Files > Operations >Write Rule Type >Files > Operations >Symlink Rule Type >Files > Operations >Hard link Rule Type >Files > Operations >Rename Rule Type >Files > Operations >Change owner Access Protection Access Protection Access Protection Access Protection Access Protection Access Protection Access Protection Rule > Add Subrule > Linux Subrule > Create Rules > Linux Rule > Linux Subrule > Read Rules > Linux Rule > Linux Subrule >Write Rules > Linux Rule > Linux Subrule >Symlink Rules > Linux Rule > Linux Subrule >Hard Link Rules > Linux Rule > Linux Subrule >Rename Rules > Linux Rule > Linux Subrule >Change owner McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 9

10 1 Migrated policies and their equivalent settings Migrated settings from Host Intrusion Prevention to Endpoint Security for Linux In Host Intrusion Prevention Standard IPS Subrule Properties Parameters > Include and Exclude In Endpoint Security for Linux Access Protection Rules > Linux Rule> Executables > Include and Exclude Parameters > Executables Access Protection Rules > Linux Rule > Executables Parameters > Files Access Protection Rule > Linux Subrule > Linux Subrule Target > File path Parameters > Source Access Protection Linux Rule > Linux Subrule > Linux Subrule Target > Destination File Parameters > User Name Access Protection Linux Rule > User Name 10 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

11 2 Error codes Exit codes There are codes assigned for each command executed in the standalone Linux systems. Here is a list of the available exit codes and their descriptions. Table 2-1 Exit values and descriptions Value Description 0 The command is successfully executed. 99 Help is not found for the specified option. 100 Error while parsing the command-line options. 101 Failed to execute the command as the option specified, or one of the values provided is invalid. 102 Error while trying to set an unsupported preference. 103 Failed to execute the command. This can be due to a communication error in ESP for Linux, if the options provided are invalid or McAfee Endpoint Security for Linux Threat Prevention service is not running. 104 Failed to register with ESP for Linux. This can be due to ESP for Linux service not running. 105 Failed to execute the command due to the user not having sudo or root privileges. 106 Failed to execute the command due to exception in Boost. 107 Failed to execute the command due to unknown exception. 108 No change is made as the specified preference is already set. 109 Failed to add the task as it is already present. 110 No change is made as the specified task is already running. 111 No change is made as the specified task is already stopped. 120 Product has expired. 121 Product is not running. McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 11

12 2 Error codes Exit codes 12 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

13 3 Managing software on McAfee epo and Cloud Contents Access Protection page Queries for Threat Prevention Queries for Access Protection Other queries Access Protection page Protect your system's access points based on configured rules. Access Protection compares a requested action against the list of configured rules and acts according to the rule. Table 3-1 Option definitions Section Option Definition Access Protection Enable Access Protection Enables the Access Protection feature. McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 13

14 3 Managing software on McAfee epo and Cloud Access Protection page Table 3-2 Advanced options Section Exclusions Option Description Allows access to the specified item for all rules. Add Adds a item to the exclusion list. Operating System Windows Adds a Windows exclusion. Linux Adds a Linux exclusion. Delete Deletes the selected item. Actions Edit Changes the selected item. Duplicate Creates a copy of the selected item. Rules Configures Access Protection rules. You can enable, disable, and change McAfee-defined rules, but you can't delete these rules. Add Creates a custom rule and adds it to the list. Operating System Windows Adds a rule for Windows systems. Linux Adds a rule for Linux systems. Edit Changes the selected item. Delete Deletes the selected item. Duplicate Creates a copy of the selected item. Block Blocks access attempts without logging. Report Logs without blocking access attempts. Block and Report Blocks and logs access attempts. Block All Selects or deselects Block for all rules. Report All Selects or deselects Report for all rules. Best practice: When the full impact of a rule is not known, select Report but not Block to receive a warning without blocking access attempts. To determine whether to block access, monitor the logs and reports. To disable the rule, deselect both Block and Report. 14 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

15 Managing software on McAfee epo and Cloud Access Protection page 3 Add or Edit rule page Add or edit user-defined Access Protection rules. Table 3-3 Option definitions Section Option Definition Options Name Specifies or indicates the name of the rule. (Required) Action Specifies actions for the rule. Block Blocks access attempts without logging. Report Warns without blocking access attempts. Block and Report Blocks and logs access attempts. Best practice: When the full impact of a rule is not known, select Report but not Block to receive a warning without blocking access attempts. To determine whether to block access, monitor the logs and reports. To disable the rule, deselect both Block and Report. Executables Specifies executables for the rule. The executable is the process that performs the subrule operation on the subrule target. Add Creates an executable and adds it to the list. Delete Deletes the selected item. Toggle Inclusion Status Changes the inclusion status of the item between Include and Exclude. Actions Edit Changes the selected item. Duplicate Creates a copy of the selected item. User Names Specifies user names that the rule applies to (for user-defined rules only). Add Selects a user name and adds it to the list. Delete Deletes the selected item. Toggle Inclusion Status Changes the inclusion status of the item between Include and Exclude. Actions Edit Changes the selected item. Duplicate Creates a copy of the selected item. Subrules Configures subrules (for user-defined rules only). Add Creates a subrule and adds it to the list. Delete Deletes the selected item. Actions Edit Changes the selected item. Duplicate Creates a copy of the selected item. Notes Provides more information about the item. McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 15

16 3 Managing software on McAfee epo and Cloud Access Protection page User page Add or edit the user that the Access Protection rule applies to (for user-defined rules only). Table 3-4 Option definitions Option Name Inclusion status Definition Specifies the name of the user that the rule applies to. Use this format to specify the user on Linux systems: username. For example, appsadm. Specifies the inclusion status for the user. Include Triggers the rule if the specified user runs the executable that violates a subrule. Exclude Doesn't trigger the rule if the specified user runs the executable that violates a subrule. Subrule page Add or edit user-defined Access Protection subrules. Table 3-5 Option definitions Section Option Definition Description Name Specifies the name of the subrule. Properties Subrule type Specifies the subrule type. Changing the subrule type removes any previously defined entries in the Targets table. Files Protects a file or directory. For example, create a custom rule to block or report attempts to delete an Excel spreadsheet that contains sensitive information. Processes Protects the specified process. For example, create a custom rule to block or report attempted operations on a process. 16 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

17 Managing software on McAfee epo and Cloud Access Protection page 3 Table 3-5 Option definitions (continued) Section Option Definition Operations Indicates the operations permitted with the specified subrule type. You must specify at least one operation to apply to the subrule. Files: Best practice: To avoid impacting performance, don't select the Read operation. Create Blocks or reports creation of files in the specified folder. Delete Blocks or reports deletion of files in the specified folder. Execute Blocks or reports execution of files in the specified folder. Change permissions Blocks or reports changing permissions settings of files in the specified folder. Read Blocks or reports read access to the specified files. Rename Blocks or reports rename access to the specified files. If the Destination file target is specified, Rename is the only valid operation. If the Destination file target is specified, Rename, Symlink, and Hard link are the only valid operations. See Rename operation target examples. Write Blocks or reports write access to the specified files. Hard link Blocks or reports creation of hard links. Symlink Blocks or reports creation of symbolic links. Change owner Blocks or reports changing ownership of a file. Processes: Terminate Blocks or reports opening the process with access to terminate. Run Blocks or reports running the specified target executable. You must add at least one target executable to the rule. For the Run operation, an event is generated when an attempt is made to run the target process. For all other operations, an event is generated when the target is opened. Targets Add Specifies the targets for the rule. Targets vary depending on the rule type selection. You must add at least one target to the subrule. Click Add, select the inclusion status, then enter or select the target to include or exclude. Delete Deletes the selected item. Toggle Inclusion Status Changes the inclusion status of the item between Include and Exclude. Actions Edit Changes the selected item. Duplicate Creates a copy of the selected item. McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 17

18 3 Managing software on McAfee epo and Cloud Access Protection page Subrule target page Specify the inclusion status and definition for an Access Protection subrule target. Table 3-6 Option definitions Section Option Definition Targets Inclusion status Determines whether the target is a positive match for the subrule. Also specifies the status of the inclusion for the target. Include Indicates that the subrule can match the specified target. Exclude Indicates that the subrule must not match the specified target. Add a target with either an Include or Exclude directive. If you selected the Files subrule type... Specifies the file name, folder name, path, or drive type target for a Files subrule. File path Enter the file name, folder name, or file path. Destination file Enter the target file name or path for Rename, Symlink, or Hard link operations. 18 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

19 Managing software on McAfee epo and Cloud Access Protection page 3 Table 3-6 Option definitions (continued) Section Option Definition If the Destination file target is selected, the Rename, Symlink, or Hard link operation must be selected. You can use?, *, and ** as wildcards. Files subrule target best practices For example, to protect: A file or folder named /tmp/test, use a target of /tmp/test The contents of the folder, use the asterisk wildcard /tmp/testdir/* The contents of the folder and its subfolders, use 2 asterisks /tmp/testdir/** Rename operation target examples To prevent files from being renamed, select the Rename operation, then set the subrule target: To prevent any file from being renamed to newname.txt, set the Destination file target to "newname.txt". To prevent original.txt from being renamed to any other name, set the File path target to "original.txt". To prevent only the original.txt file from being renamed to newname.txt, specify 2 subrule targets: Set the File path target to "original.txt". Set the Destination file target to "newname.txt". Hard link operation target examples To prevent creating hard links to files, select the Hard link operation, then set the subrule target: To prevent creating a hard link with the name hardlinktofile to any file, set the Destination file target to "hardlinktofile" To prevent creating a hard link with any other name to the originalfile.txt file, set the File path target to "originalfile.txt" To prevent only creating a hard link to the originalfile.txt file with the name hardlinktofile, specify two subrule targets: Set the File path target to "originalfile.txt". Set the Destination file target to "hardlinktofile". Symlink operation target examples To prevent creating symbolic links to files, select the Symlink operation, then set the subrule target: To prevent creating a symbolic link with the name symlinktofile to any file, set the Destination file target to "symlinktofile". To prevent creating a symbolic link with any other name to the originalfile.txt file, set the File path target to "originalfile.txt" To prevent only creating a symbolic link to the originalfile.txt file with the name symlinktofile, specify two subrule targets: Set the File path target to "originalfile.txt". Set the Destination file target to "symlinktofile". Change owner operation target examples McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 19

20 3 Managing software on McAfee epo and Cloud Access Protection page Table 3-6 Option definitions (continued) Section Option Definition To prevent changing file ownership, select the Change owner operation, the set the subrule target. For example, to protect: A file or path named /tmp/mypath, set the subrule target to "/tmp/mypath" A file named myfile.txt, use a target file name or path of myfile.txt All files in a folder, use the asterisk wildcard. /tmp/test/* All files in a folder and its subfolders, use two asterisks. /tmp/test/** If you selected the Processes subrule type... Specifies the process file name or path for a Processes subrule. You can use?, *, and ** as wildcards. Processes subrule target best practices For example, to protect: A process named /testexec, use a target file name or path of /testexec All processes in a folder, use the asterisk wildcard /tmp/test/* All processes in a folder and its subfolders, use 2 asterisks /tmp/test/** Add or Edit Exclusion page Add or edit an executable to exclude from on-access scans or on-demand scans. Table 3-7 Option definitions Section Option Definition type What to exclude File name or path Specifies the type of exclusion and the details for the exclusion. Specifies the file name or path to exclude. The file path can include wildcards. To exclude a folder on Mac or Linux systems, append a slash (/) character to the path. You can use a single? character as the root of a file path. For example,?:\abc matches the root-level ABC folder for all drives. Select Also exclude subfolders if necessary. On-Demand When to exclude Notes File type On read On write Specifies file types (file extensions) to exclude. Specifies when to exclude the selected item. Excludes from scanning when files are being read from the computer or other data storage device. Excludes from scanning when files are being written to or modified on the disk or other data storage device. Specifies any additional information about the exclusions. 20 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

21 Managing software on McAfee epo and Cloud Queries for Threat Prevention 3 Queries for Threat Prevention Here is the list of queries that you can view or customize for Threat Prevention. Query... Endpoint Security Threat Prevention: Hotfixes Installed Endpoint Security Threat Prevention: Compliance Status Endpoint Security Threat Prevention: Duration of Completed Full s in the Last 7 Days Endpoint Security Threat Prevention: Systems Not Completed a Full in the Last 7 Days Endpoint Security Threat Prevention: Systems Not Completed a Full in the Last Month Endpoint Security Threat Prevention: Duration of Completed Quick s in the Last 7 Days Endpoint Security Threat Prevention: Detection Response Summary Endpoint Security Threat Prevention: Threats Detected Over the Previous 2 Quarters Endpoint Security Threat Prevention: Threat Count by Severity Endpoint Security Threat Prevention: Top 10 Detected Threats Endpoint Security Threat Prevention: Top 10 Threat Sources Endpoint Security Threat Prevention: Top 10 Computers with the Most Detections Endpoint Security Threat Prevention: Top 10 Threats Per Threat Category Endpoint Security Threat Prevention: Top 10 Users with the Most Detections Endpoint Security Threat Prevention McAfee GTI Sensitivity level Endpoint Security Threat Prevention On-Demand Full GTI sensitivity level Endpoint Security Threat Prevention On-Demand Quick GTI sensitivity level Displays... The hotfixes installed for the software. This is the compliance status. The duration of the completed Full in the last seven days. The number of systems that have not completed a Full in the last seven days but within the last month. The number of systems that have not completed a Full in the last month. The duration of the completed Quick in the last seven days. The number of threats where an action was taken (Clean, or Delete), versus the number threats where no action was taken, in the last three months. The threats detected in the previous two quarters. The number of events (slice counts) and event severities (slices) that occurred in the last three months. The top 10 detected items in the last three months. The top 10 computers that are the source for a threat in the last three months. The 10 ten computers with the most detections in the last three months. The top 10 threats per threat category in the last three months, grouped by threat category then by threat name. The top 10 users with the most detections in the last three months. This report displays the McAfee GTI sensitivity level for s. This report displays the McAfee GTI sensitivity level for On-Demand Full s. This report displays the McAfee GTI sensitivity level for On-Demand Quick s. Queries for Access Protection Here is the list of queries that you can view or customize for Access Protection. Query... Endpoint Security Threat Prevention: Access Protection Compliance Status Endpoint Security Threat Prevention: Top 10 Access Protection Rules Broken Displays... This is the Access Protection compliance status report. Displays the top ten most frequently broken access protection rules in the last three months. McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide 21

22 3 Managing software on McAfee epo and Cloud Other queries Other queries Run these queries to generate reports, or modify them to generate custom reports. Query.. Endpoint Security: Top Infected Users in the Last 7 Days Endpoint Security: Primary Vectors of Attack in the Last 7 Days Endpoint Security: Top Threats in the Last 48 Hours Endpoint Security: Threats Detected in the Last 24 Hours Endpoint Security: Threats Detected in the Last 7 Days Endpoint Security: Summary of Threats Detected in the Last 24 Hours Endpoint Security: Summary of Threats Detected in the Last 7 Days Endpoint Security: Currently Enabled Technology Endpoint Security: Policy Compliance by Computer Name Endpoint Security: Policy Compliance by Policy Name Endpoint Security: Self Protection Compliance Status Endpoint Security Platform: Hotfixes Installed Endpoint Security: Installation Status Report Displays... The list of top infected users in the last seven days. The list of Primary Vectors of Attack in the last seven days. The list of top threats in the last 48 hours. The number of threat events generated in the last 24 hours. The number of threat events generated in the last seven days. The summary of threats detected in the last 24 hours. The summary of threats detected in the last seven days. The list of technology that are currently enabled on each managed system. Two lists of computers which do and do not have the latest policy applied. A Boolean pie chart showing that policies have and have not been updated on the client system. The list of self-protection compliance status report. The list of hotfixes installed for the software. The stacked bar chart of multiple modules and their installation status. 22 McAfee Endpoint Security for Linux Threat Prevention Interface Reference Guide

23 0-00