McAfee MVISION Mobile epo Extension 1809 Product Guide September 11, 2018
COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. McAfee MVISION Mobile epo Extension 1809 Product Guide 2
Contents Product Overview... 4 Key features... 4 How it works... 4 What happens during an attack... 4 Configuration: MVISION Mobile epo Extension... 5 Prepare to Install McAfee MVISION Mobile Extension... 5 Supported environments and Known issues... 5 Install MVISION Mobile extension... 5 Configure API Details... 5 Configure (or modify default) Server s... 6 Visibility Overview... 7 MVISION Mobile Page... 7 MVISION Mobile Activity Widget... 8 Threat Event Summary... 8 Most Attacked Security Intelligence... 8 Metrics... 9 Risk Management... 10 MVISION Mobile Threat Detection Application Version Distribution... 10 OS Version Distribution... 10 Devices and Vulnerable OSs... 11 MVISION Mobile Threat Logs... 11 Export Threat Log... 13 Threat Workflow... 13 Approve Option... 13 Mark as Fixed Option... 13 MVISION Mobile Devices... 14 MVISION Mobile Console (or configuration)... 15 Removing MVISION Mobile Extension... 16 McAfee MVISION Mobile epo Extension 1809 Product Guide 3
Product Overview The McAfee epolicy Orchestrator (McAfee epo) platform enables centralized policy management and enforcement for your endpoints (including mobile devices) and enterprise security products. McAfee epo monitors and manages your network, detecting threats and protecting endpoints against these threats. By using McAfee MVISION Mobile Extension in epo you can, Monitor the health of mobile devices Collect data on events and alerts from mobile devices Manage mobile security of mobile devices via MDM based policy assignments. Please refer to MVISION Mobile Console Product Guide. Key features Visibility of all threat information in the consolidate Mobile Dashboard Detailed threat logs with options to approve or mark fixed Delete Device(s) Devices details with vulnerability information and options to delete device. Also provides a correlation on the threats events specific to each device Provides a range of manageability infrastructure options - on-premise epo and epo hosted in AWS. How it works McAfee MVISION Mobile App and MVISION Mobile Extension with McAfee epo work together to stop malware attacks on your systems and notify you when an attack occurs. What happens during an attack McAfee epo components and processes stop an attack, notify you when the attack occurs, and record the incident. 1. Malware attacks a mobile in your managed mobile device. 2. McAfee MIVISION Mobile App detects the malware file. 3. McAfee MVISION Mobile App notifies McAfee epo of the attack. 4. McAfee epo stores the attack information. 5. McAfee epo displays the notification of the attack on Threat Events dashboard and saves the history of the attack in the Threat Event Log. McAfee MVISION Mobile epo Extension 1809 Product Guide 4
Configuration: MVISION Mobile epo Extension Prepare to Install McAfee MVISION Mobile Extension Before you install McAfee MVISION Mobile Extension for the first time, Ensure that the epo version is one of the following: a. epo On-premise 5.10 or later b. epo Hosted on AWS Download the McAfee MVISION Mobile Extension from https://support.mcafee.com (using your grant number) or from epo Software Download Manager Supported environments and Known issues Review the supported environments and known issues before completing your installation. Supported platforms, environments, and operating systems for MVISION Mobile: KB90796 Known issues KB90799 Install MVISION Mobile extension Before you invite users to download and install MVISION Mobile App, add the extension to McAfee epo. 1. Download the MVISION Mobile extension, MVisionMobile.zip to the system with McAfee epo. You can download MVISION Mobile Extension from McAfee epo Software Manager. See McAfee epo product documentation for more details. 2. Install MVISION Mobile extension: a. In McAfee epo, select Menu Software Extensions. b. Click Install Extension. c. Browse to the location of MVisionMobile.zip, select it, then click OK. The Install Extension summary page appears. d. Click OK to complete the installation of the extension. Configure API Details Configure the API URL and API Key so that McAfee MVISION Mobile Extension can pull required information from backend. 1. Click Menu Configuration Server Settings. 2. In the Server Settings page, click Mobile Server Settings in the Setting Categories pane. 3. Click Edit. 4. Enter the API Server Url and Server API Key that you received in the Welcome email. 5. Click Test Connection to check if it is successful. 6. Click Save. McAfee MVISION Mobile epo Extension 1809 Product Guide 5
Configure (or modify default) Server s Two server tasks are added with a schedule to run every 60 minutes. 1. Mobile Device Pull 2. Mobile Threat Event Pull You can modify the schedule by editing these server tasks or create new tasks. If you are creating new tasks, make sure you disable the default task after editing and setting scheduled status as disabled. Edit or create a new Server : MVISION Mobile Device Pull 1. Click Menu Automation Server tasks. 2. In the Server s page, type mvision in the quick find search box and click Apply or manually find the above tasks. 3. Select MVISION Mobile Device Pull 4. Click Edit. 5. Change or keep the default name. 6. Add notes, if any. 7. Keep scheduled status as Enabled. 8. Click Next. 9. Keep Actions as Mobile Device Pull Command. 10. Click Next. 11. Define the Schedule as per your need 12. Click Save Edit or create a new Server : MVISION Mobile Threat Pull 3. Click Menu Automation Server tasks. 4. In the Server s page, type mvision in the quick find search box and click Apply or manually find the above tasks. 13. Select MVISION Mobile Threat Pull 14. Click Edit. 15. Change or keep the default name. 16. Add notes, if any. 17. Keep scheduled status as Enabled. 18. Click Next. 19. Keep Actions as Mobile Threat Pull Command. 20. Click Next. 21. Define the Schedule as per your need 22. Click Save You can run these tasks immediately by clicking run in Server s page. McAfee MVISION Mobile epo Extension 1809 Product Guide 6
Visibility Overview MVISION Mobile Page MVISION Mobile Dashboard provides a summary of the threats in your mobile environment including the number of scanned devices, networks and Apps. You can drill down by clicking on each number to get more details on each item. 1. Click Menu MVISION MVISION Mobile. 2. In the MVISION Mobile page, click any of the numbers in the top ribbon to go to detailed threat or devices page. The figure below shows the MVISION Mobile page that provides a single view of your protected mobile devices, security intelligence, and events, regardless of their group. Most items in this page have live data and take you to their corresponding page when clicked. This page is composed of several sections that provide a snapshot of your inventory status and security intelligence. McAfee MVISION Mobile epo Extension 1809 Product Guide 7
MVISION Mobile Activity Widget The dashboard activity widget provides administrators an overview of system activity. Activity reported includes counts for devices, networks and apps analyzed and threats detected. Clicking the Threats Detected value in red navigates to the Threat Log with the target events filtered in. Threat Event Summary The Threat Log located in the MVISION Mobile page displays all recent security events. Most Attacked Security Intelligence The two sections in the dashboard: Most Attacked Users/Devices Most Attacked Networks provide intelligence in your inventory on the top 5 users/devices attacked and the top 5 networks attacked. This allows you to concentrate efforts on these users and networks to understand better why they are seeing these events. The list dynamically updates per the time frame selected at the top of the Dashboard. Clicking the Email/Device ID field in the Most Attacked Users/Devices section brings you to the events for this user in the Threat Log page. You can click the star icon in the Most Attacked Networks section to enable a differentiator for that network. McAfee MVISION Mobile epo Extension 1809 Product Guide 8
Metrics Metrics that are displayed at the middle of the Dashboard reflect your device and configuration inventory. It contains the following subsections: MVISION Mobile Threat Detection Application Operational Mode MVISION Mobile Threat Detection Application Version Distribution Operating system Version Distribution Risk Management MVISION Mobile Threat Detection Application Operational Mode The operational mode widget provides an at-a-glance view of the status of devices from an MVISION Mobile Threat Detection Application deployment perspective, without the need to access the MDM. Mode Active Inactive Description Devices with MVISION Mobile Threat Detection Application deployed, started, and communicating to MVISION Mobile Console. Devices that have not been in contact with MVISION Mobile Console according to the Device Inactivity Configuration setting in the Manage page. McAfee MVISION Mobile epo Extension 1809 Product Guide 9
Pending Activation When a device is first synchronized over it is marked in an Active state. If it has not activated before the inactivity period defined, it is then marked as Pending Activation. Risk Management The risk management widget shows the risk status for devices within the organization. Risk Jailbroken Developer Mode 3 rd Party App Store High-Risk Devices Description The number of devices that MVISION Mobile Threat Detection Application detected as either Jailbroken/Rooted or in the process of being Jailbroken/Rooted. The number of devices that MVISION Mobile Threat Detection Application detected with USB Debugging enabled. The number of devices that MVISION Mobile Threat Detection Application detected with the Unknown Sources configuration option is enabled. The number of devices that MVISION Mobile Threat Detection Application detected with the Stage fright vulnerability. MVISION Mobile Threat Detection Application Version Distribution Displays the distribution of MVISION Mobile Threat Detection Application versions inside the organization. OS Version Distribution Displays the distribution of mobile operating systems in the organization (Android, ios, Windows). Hover over the graph to see the number of devices and the OS versions. McAfee MVISION Mobile epo Extension 1809 Product Guide 10
Devices and Vulnerable OSs Metrics that are displayed at the bottom of the Dashboard reflect your device that are running vulnerable OSs: MVISION Mobile Threat Logs When you click on a Red number in the Activity Widget in MVISION Mobile page (top bar), you will land at the Threat Log page which provides visibility into all threats (events) that are seen from protected devices running MVISION Mobile Threat Detection Application. Using the columns selection at the bottom of page under Action, the Administrator can change which data is displayed for easy forensics review. Clicking a threat in the list provides the complete forensics information collected in a side window. Provides visibility of each threat. Following details are provided in the Mobile Threat Logs page: Severity Device ID User email Event Name OS Event State Persisted Time Additional Threat details are available when you select individual threat. 1. Click Menu MVISION Mobile Click on a red number in the top ribbon (Activity Widget). 2. In the Mobile Threat Event Log page, click on a row in the table. 3. The Threat Event Details card opens with additional threat details. You can assign mark each threat event for tracking. 1. Click Menu MVISION Mobile Mobile Threat Event Log. 2. In the Mobile Threat Event Log page, select a row in the table. 3. Click Actions at the bottom of the page 4. Select one of the following options a. Approve Threat As b. Mark As Fixed With 5. If you select Approve Threat As option, you can select one of the following options: a. Developer Testing McAfee MVISION Mobile epo Extension 1809 Product Guide 11
b. Known App c. User Was Instructed d. Other 6. If you select Mark As Fixed With option, you can select one of the following options: a. Developer Testing b. Known App c. User Was Instructed d. Other If you want to get the latest status of Threats than your scheduled time to pull data, you can refresh the Threats data by following these steps: 1. Click Menu MVISION Mobile Mobile Threat Event Log. 2. In the Mobile Threat Event Log page, Click Actions at the bottom of the page 3. Select Refresh You can also add a filter to show only relevant threats. 1. Click Menu MVISION Mobile Mobile Threat Event Log. 2. In the Mobile Threat Event Log page, click on the dropdown list in Custom box. 3. Select Add. 4. Select one of the criteria to filter from the Available Properties pane. 5. Define your filtering criteria 6. Click Update Filter. You can add additional columns to show more details about threat: 1. Click Menu MVISION Mobile Mobile Threat Event Log. 2. In the Mobile Threat Event Log page, click on the Actions at the bottom of the page. 3. Select Choose Columns. 4. Select items from the Available Columns pane. 5. Click Save. 6. You can revert to the default columns by clicking Use Default. The table describes information about each column displayed in the Threat Log. Column Severity Threat Name User Device ID App Name Description Select which threats you want to view by severity: Critical, Elevated, Low, Normal. Each threat is assigned a name in the format threat_vector.category.event_name where: threat_vector is the host or network category is the category type of the event event_name is the threat attack name Employee name or email address. Device identifier. ID of the MVISION Mobile Threat Detection Application reporting the event. There are certain situations when Android For Work or KNOX is deployed that MVISION McAfee MVISION Mobile epo Extension 1809 Product Guide 12
State Action Triggered Time stamp Mobile Threat Detection Application shows up as MVISION Mobile Threat Detection Application AFW or MVISION Mobile Threat Detection Application KNOX. Defined from the Dashboard workflow. Default for a new event is Pending and then becomes Approved/Fixed when changed by the Administrator or when the threat has been resolved/mitigated. Sort by action performed when this event was detected. Sort by the range of dates selected. Export Threat Log Events can be exported from the Threat Log screen by using the export action under Action menu. This includes the filtered event log only and is downloaded as a CSV file. Threat Workflow An MVISION Mobile Console Admin can execute a workflow for a specific threat or event by clicking the checkbox to the left of the row and choosing which workflow from the Actions drop-down. Approve Option The option to select the event as Approved sets that specific event as whitelisted by the administrator. For example, when the security team conducts a pen test, it generates threats on the system. To avoid the associated noise, these threats are marked as approved. When Approved is selected, some predefined approval reasons are displayed. The Administrator can choose one of them or type in another reason in the box provided. Once the Approve box is clicked, the event is removed from this screen but stays in the Threat Log page marked as Approved. Mark as Fixed Option The option to mark the event as Fixed clarifies that this specific event was considered a security problem (such as a malicious app found on a device) and was resolved by the Incident Response team/admin. When Fixed is selected, three predefined fixed reasons are displayed. The Administrator can choose one of the them or type in another reason in the box provided. Once the Mark as Fixed box is clicked, the event is removed from this screen but stays in the Threat Log page marked as Fixed. McAfee MVISION Mobile epo Extension 1809 Product Guide 13
MVISION Mobile Devices When you click on a black number in the Activity Widget (at the top Ribbon) you will be directed to the Devices page which displays the complete list of devices that are configured in this environment. Devices automatically appear in this page when a user has activated MVISION Mobile Threat Detection Application with this environment For MDM-integrated environments, this page lists devices that are synchronized from an MDM This page provides visibility of each mobile device. Following details are provided: Risk Posture (For example, Low, Elevated, Critical) User Group Operating system (Version of the device) Upgradeable operating system (Yes No, or N/A). The figure below has this column hidden. Device ID Model (for example, iphone, Nexus 5) App Version (for MVISION Mobile Threat Detection Application). The figure below has this column hidden. Privileges (For example, Rooted, Jailbroken, No Jailbroken) Operational Mode (Inactive, Active) Last Seen (Last date and time the device was seen by the MVISION Mobile Console, via check-in or from event communication) Additional device details are available when you select individual devices. 1. Click Menu MVISION Mobile Click on the black number on Activity Widget. 2. In the Mobile Devices page, click on a row in the table. 3. The Device Details card opens with additional threat details a. Device Type: iphone/android b. Warnings if any (based on number of vulnerabilities c. App Details d. Vulnerabilities e. Device State: Active/Inactive You can find the threats for a specific device by clicking on Show Threat for this device. You can delete individual devices. 1. Click Menu MVISION Mobile Mobile Devices. 2. In the Mobile Devices page, select a row in the table. 3. Click Actions at the bottom of the page 4. Select Delete Device 5. A confirmation prompt will come up, select yes This action removes the device from MVISION Mobile Console. For MDM devices, if you remove a device from MVISION Mobile Console and then you perform a sync, the device is added back to MVISION Mobile Console. If you want to get the latest status of devices than your scheduled time to pull data, you can refresh the devices by following these steps: 1. Click Menu MVISION Mobile Mobile Devices. 2. In the Mobile Devices page, Click Actions at the bottom of the page 3. Select Refresh McAfee MVISION Mobile epo Extension 1809 Product Guide 14
You can also add a filter to show only relevant devices. 1. Click Menu MVISION Mobile Mobile Devices. 2. In the Mobile Devices page, click on the dropdown list in Custom box. 3. Select Add. 4. Select one of the criteria to filter from the Available Properties pane. 5. Define your filtering criteria 6. Click Update Filter. You can add additional columns to show more details about device: 1. Click Menu MVISION Mobile Mobile Devices. 2. In the Mobile Devices page, click on the Actions at the bottom of the page. 3. Select Choose Columns. 4. Select items from the Available Columns pane. 5. Click Save. 6. You can revert to the default columns by clicking Use Default. You can export the threat list on the page by using the export option in Actions menu. This export includes the filtered device list only and is downloaded as a CSV file. clicking a device displays the Device Details window seen in the figure. Details of the device including vulnerable configuration items and alerts are displayed. At the bottom of the window are some actions and items that can display more information about the device: To show threats for this device, click the Show threats for this device link. If no threats are available, the link does not show up and is replaced by No Threats detected for this device. MVISION Mobile Console (or configuration) Admin should go to MVISION Mobile Console via Configuration SSO link. You will have to enter your credentials that you used during activation of the MVISION product activation. to make any configuration changes. The configuration changes that can be performed at MVISION Mobile Console are: Apps o Upload App o Export to CSV Profiles Users Policy o Deploy (Group) Manage o General Set Password Policy Preferred Language Options with MVISION Mobile App with Root Access McAfee MVISION Mobile epo Extension 1809 Product Guide 15
Name Description Threat Notification Threat notification email to enduser Change Password Confirm Password reset confirmation email CSV Export CSV email to console admin Pending Activation Pending activation notification to end user Inactive Device Inactive notification to end user Forgot Password Password reset email to user Invite User Invite email to set password MDM Device Activation Link Activation link optionally sent to MDM end users Welcome After Invite Welcome email to user Configuration Enable AFW/Android Enterprise for Android devices o Privacy Deploy (Group) Forensic Data collection configuration o MDM Add o VPN Settings Deploy o Network Sinkhole Settings Block network access except ALLOW the IP Address ranges/domains below. Allow network access except BLOCK the IP Address ranges/domains below. o Roles: Edit Roles Danger Zone Site Insight Device Inactivity o Message Templates: Edit Templates Removing MVISION Mobile Extension You can remove MVISION Mobile Extension by following these steps. Note: Once you remove the extension, you will not be able to see data related to mobile devices and the data will be permanently deleted. 1. Click Menu Software Extensions. 2. In the Extensions page, search for the MVISION Mobile in the Extensions pane on the left-hand side. 3. Select MVISION Mobile. 4. Click Remove 5. You will receive a warning You have chosen to remove the "MVISION Mobile" extension. Removing this extension will permanently delete its data.. 6. Select Ok McAfee MVISION Mobile epo Extension 1809 Product Guide 16