McAfee QUICKCLEAN 1.0 User Manual download pdf (Page 20)

Task

For option definitions, click ? in the interface.

Click Menu | Systems | TIE Reputations.

Click the File Search tab.

Enter a specific file name, or search for files by name or by file type, such as .dll or .exe. You can

also use wildcard search characters * or ? when searching.

Select the file that you want to see.

From the Actions menu, click Where Has File Run.

Systems that have run the file are listed, including the system name, IP address, and the first date the

file ran on that system.

Monitoring events

The TIE module for VSE Events page shows recent Threat Intelligence Exchange events and security

threats, and the actions taken.

Viewing recent events

Viewing recent events allows you to see threat information about your systems.

You can view enforced or observed events:

• Enforcement Events — Events that occur as a result of an enforced Threat Intelligence Exchange policy.

• Observation Events — Events that occur if the policy is enforced. It allows you to view, evaluate, and

adjust policy and configuration settings before enforcing them. You can see which files or

certificates are causing events, and change their reputation settings so they no longer generate an

event.

You can view threat events in several ways and drill down for more information:

Past 30 days — Event summary information for the past 30 days.

Top 10 — The top 10 events by system, file, or certificate.

Certificate — The certificate name, its SHA1 value, and the number of certificates that were cleaned,

blocked, or prompted.

File Hash — The file name and SHA1 value, and the number of files that were cleaned, blocked, or

prompted.

Rule — The rule name, events where the rule was applied, and the number of rules that were cleaned,

blocked, or prompted.

System — The system name, total events for that system, and the number of events that were cleaned,

blocked, or prompted on a particular system.

Using Threat Intelligence Exchange

Monitoring events

McAfee Threat Intelligence Exchange 1.0.0 Product Guide

1 2 ... 15 16 17 18 19 20 21 22 23 24 25 ... 28 29

No comments

McAfee QUICKCLEAN 1.0 User Manual Page 20