cancel
Showing results for 
Search instead for 
Did you mean: 
work
Level 7
Report Inappropriate Content
Message 1 of 6

Network Intrusion Prevention

Jump to solution

Within the Exploit Prevention category policy for Endpoint Security Threat Prevention, there is an option called "Network Intrusion Prevention". Any one have some info on what this does? I could not find anything on it within the manual for Endpoint security.

Screen_Shot_2017-12-20_at_1_35_33_PM.png

2 Solutions

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Network Intrusion Prevention

Jump to solution

@Majidkhan For the answers to your questions, please review the ENS Threat Prevention Product Guide PD27574, beginning on Page 15, with the section "How Signatures Protect Applications and Systems", continuing to "How Network IPS Works".

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Network Intrusion Prevention

Jump to solution

1. Ensure that you have the Network IPS signatures set to BLOCK and/or REPORT; there are 16 NIPS signatures in the ENS Exploit Prevention policy (review the Signature list, and use the Network IPS filter).  If Network IPS signatures are triggered, ePO events will be generated for that activity.  Review the ePO Threat Event menu for NIPS events; these should be Event ID 18059 events with Event Category Host intrusion (hip.nips) values.

2. Correct.  When a NIPS signature triggers, the ENS client would automatically block all traffic from the remote IP address that triggered the signature for the specified amount of time.  The NIPS event in ePO will contain the remote IP address details as the Threat Source IP address value.

3. Network IPS signatures are provided via the monthly ENS Exploit Prevention Content updates (which are separate from Antivirus DAT content updates).  There won't necessarily be a new signature every month though; the last NIPS signature added was Sig 6119 - SMB Double Pulsar Ping, which was released Oct 2018 in the 10.6.0.8701 content.

5 Replies

Re: Network Intrusion Prevention

Jump to solution

They could really do it justice if they included the option to exclude IP's / Subnets.

Enable Network Intrusion Prevention option — Enables Network Intrusion Prevention (NIPS) and enforces network IPS signatures. Selecting this option exposes Network IPS signatures in the Signatures list. Automatically block network intruders option — Blocks intruder hosts for a specified number of seconds. Select this option to block all attempted actions from intruder hosts, even if the action for the Network IPS signature isn't set to Block. • Number of seconds (1-9999) to block — 6pecifies the number of seconds to automatically block intruders. Automatically block network intruders This text will be included in the next version of the documentation.

Does that help at all? I can go into greater detail if desired. That is from their update

mikee
Level 7
Report Inappropriate Content
Message 3 of 6

Re: Network Intrusion Prevention

Jump to solution

I have the same question. Anyone who knows where I could find information on this?

Re: Network Intrusion Prevention

Jump to solution

Hi,

1. With this option enabled "Enable Network Intrusion Prevention" does it not reports us the intrusions detected on which specified hosts? 

2. Automatically block network intruders does that mean the affected machine where it matches the signatures would be blocked automatically till the specified time in secs. After which it will unblock that machine (release) again?

3. Network Intrusion Prevention signatures would be updated via DAT (Endpoint Security Exploit Prevention Content) every month?

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Network Intrusion Prevention

Jump to solution

@Majidkhan For the answers to your questions, please review the ENS Threat Prevention Product Guide PD27574, beginning on Page 15, with the section "How Signatures Protect Applications and Systems", continuing to "How Network IPS Works".

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Network Intrusion Prevention

Jump to solution

1. Ensure that you have the Network IPS signatures set to BLOCK and/or REPORT; there are 16 NIPS signatures in the ENS Exploit Prevention policy (review the Signature list, and use the Network IPS filter).  If Network IPS signatures are triggered, ePO events will be generated for that activity.  Review the ePO Threat Event menu for NIPS events; these should be Event ID 18059 events with Event Category Host intrusion (hip.nips) values.

2. Correct.  When a NIPS signature triggers, the ENS client would automatically block all traffic from the remote IP address that triggered the signature for the specified amount of time.  The NIPS event in ePO will contain the remote IP address details as the Threat Source IP address value.

3. Network IPS signatures are provided via the monthly ENS Exploit Prevention Content updates (which are separate from Antivirus DAT content updates).  There won't necessarily be a new signature every month though; the last NIPS signature added was Sig 6119 - SMB Double Pulsar Ping, which was released Oct 2018 in the 10.6.0.8701 content.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community