McAfee QUICKCLEAN 1.0 User Manual download pdf (Page 17)

Scenarios

• Your site commonly uses a file whose default reputation is unknown or might be classified malicious

because it is a custom file. Because you know the file is safe, you can change its reputation to

trusted so that it runs without interference.

• You want to block a common, trusted file from running in your environment, such as a file that

allows remote desktop access. You can change its reputation to malicious, blocking it from running

on systems in your environment.

• Users are notifying you that they are prompted when a specific file tries to run. You look up the

file's reputation and see that is in unknown. You then look at the file details and determine that it is

a trusted file. You can then change its reputation to trusted so that it no longer prompts users.

• You have set file or certificate reputations and you want to import them into the Threat Intelligence

Exchange database. You can add those reputations one at a time, or in a batch using an XML file.

Change the reputation of a file or certificate

Change the reputation of a file or a certificate to allow or block it in your environment.

Task

For option definitions, click ? in the interface.

Click Menu | Systems | TIE Reputations.

Click the File Search or Certificate Search tab.

Search for files or certificates by name or by file type, such as .dll or .exe. You can also use

wildcard search characters * or ?.

To view details about a specific file or certificate, including its hash number, click its name. Examine

the details and VirusTotal information for the file to determine how to classify it.

Using Threat Intelligence Exchange

Changing default threat reputations

McAfee Threat Intelligence Exchange 1.0.0 Product Guide

1 2 ... 12 13 14 15 16 17 18 19 20 21 22 ... 28 29

No comments

McAfee QUICKCLEAN 1.0 User Manual Page 17