McAfee QUICKCLEAN 3.0 User's Guide download pdf (Page 86)

To dynamically analyze a file, the corresponding user must have the VM profile specified in the

user's analyzer profile. This is how the user indicates the environment in which McAfee Advanced

Threat Defense should execute the file. You can also specify a default Windows 32-bit and a 64-bit

VM profile.

• User — A McAfee Advanced Threat Defense user is one who has the required permissions to submit

files to McAfee Advanced Threat Defense for analysis and view the results. In case of manual

submission, a user could use the McAfee Advanced Threat Defense web application or an FTP client.

In case of automatic submission, you integrate McAfee products such as McAfee Network Security

Platform or McAfee Web Gateway with McAfee Advanced Threat Defense. Then when these

products detect a file download, they automatically submit the file to McAfee Advanced Threat

Defense before allowing the download to complete. So, for these products default user profiles are

available in McAfee Advanced Threat Defense.

For each user, you define the default analyzer profile, which in turn can contain the VM profile. If

you use the McAfee Advanced Threat Defense for uploading files for analysis, you can override this

default profile at the time of file submission. For other users, McAfee Advanced Threat Defense

uses the default profiles.

High-level steps for configuring malware analysis

This section provides the high-level steps on how to configure McAfee Advanced Threat Defense for

malware analysis and reporting:

Figure 6-1 Summarized steps for configuring malware analysis

Set up the McAfee Advanced Threat Defense Appliance and ensure that it is up and running.

• Based on your deployment option, make sure the McAfee Advanced Threat Defense Appliance

has the required network connections. For example, if you integrate it with Network Security

Platform, make sure the Sensor, Manager, and the McAfee Advanced Threat Defense Appliance

are able to communicate with each other.

• Make sure the required static analysis modules, such as the McAfee Gateway Anti-Malware

Engine are up-to-date.

Create the analyzer VMs and the VM profiles. See Creating analyzer VM on page 4.

Create the analyzer profiles that you need. See Managing analyzer profiles on page 87.

If you want McAfee Advanced Threat Defense to upload the results to an FTP server, configure it

and have the details with you before you create the profiles for the corresponding users.

Create the required user profiles. See Add users on page 35.

Log on to McAfee Advanced Threat Defense web application using the credentials of a user you

created and upload a sample file for analysis. This is to check if you have configured McAfee

Advanced Threat Defense as required. See Upload files for analysis using McAfee Advanced Threat

Defense web application on page 97.

Configuring McAfee Advanced Threat Defense for malware analysis

High-level steps for configuring malware analysis

McAfee Advanced Threat Defense 3.0.4 Product Guide

1 2 ... 81 82 83 84 85 86 87 88 89 90 91 ... 139 140

No comments

McAfee QUICKCLEAN 3.0 User's Guide Page 86